fix(csp): allow data uris for images

We need data URIs to support profile image cropping and capturing from a webcam.

@warner r?