add plugin theming

+ ‚null‘ origin requests for theme content is allowed to support custom
fonts.
-> attackers could determine the theme the user uses this way ->
POSSIBLE RISK as soon as custom themes are allowed