Use Govspeak's image source validation

This means it won't be presented as a separate message, but on the other hand
we will no longer convert every string field in a request into HTML twice.