fix(csp): allow image sources from gravatar