Restrict allowed hosts for inline images

Otherwise an editor could include an image which could be changed to something
malicious at the whim of the website owner (or an attacker).
Merge pull request #220 from alphagov/restrict_image_hosts

Restrict allowed hosts for inline images