fix(csp): allow image sources from gravatar

We should be okay with images from Gravatar.

Link to #1469.
https +1