fix CSP for data: img-src