Local mirroring breaking sites using CSP

[Artefact2]

Hi Raymond,

The local mirroring feature interferes with sites that use Content-Security-Policy headers. For example:

 Refused to load the stylesheet 'data:text/css;base64,LyogbGF0aW4gKi8KQGZvbnQtZmFjZSB7CiAgZm9udC1mYW1pbHk6IC…A3NCwgVSsyMEFDLCBVKzIyMTIsIFUrMjIxNSwgVStFMEZGLCBVK0VGRkQsIFUrRjAwMDsKfQo=' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com ".

You can reproduce the issue here: https://o.smium.org/

[gorhill]

Interesting.

At first glance, it looks like local mirroring should not kick in for sites with a CSP header, and to assume by default that such header will break redirecting to a data: URI.