use URL.createObjectURL, fixes #9