CSP: Clarifying subresource policy for SVG images/fonts. Those are safe right? ... Right?