Updated all $http.jsonp() calls to use $http.get() to pass CSP checks.
Use $sce service to sanitize html, change use of ng-bind-html-unsafe to ng-bind-html.
Upgraded to latest stable, AngularJS 1.2.16.
Add permissions for API URLs for XHR requests.
Added angular-csp.css and ngCsp directive (may not be needed).
Still need to perform separate HXR get requests on each image and cache the images locally.