Allow blob urls in images

Urls created using URL.createObjectURL are currently marked unsafe, lets fix this.

see #3889