Make img src urls safe if safe_links_only is enabled

Adding an image with src javascript:while(1); will freeze Firefox 32. I propose we make img srcs safe when safe_links_only is enabled.

/cc @robin850