Data URL loading is now controlled through a flag. Blob URLs have an origin these days.