fix(csp): allow image sources from gravatar

We should be okay with images from Gravatar.

Link to #1469.
HA! I saw that this morning, but didn't get a chance to file it yet.
Any chance we can tweak that to `https://` (both here and in the `server/lib/csp.js`).