#28 less restrictive CSP policy for linking images: we only need to be hover https or self