Content Security Policy: allowing all external images? Content Security Policy: allowing all external images? apache apache