Right now all images are blocked with the CSP.

We should support both external images (proxified, maybe approved by the user) and internal (cid:) images.