fix csp to allow data urls for images