Restrict allowed hosts for inline images

Otherwise an editor could include an image which could be changed to something
malicious at the whim of the website owner (or an attacker).