remove image.src trick to avoid data uri restriction of CSP