set image src to null to avoid data uri restriction of CSP

Fixes #7.