Zero-trust audited external resources in HTML