add img-src to security headers