support rendering svg as images, while still applying a CSP and forcing
download to prevent executing javascript they may contain