Video element with data: URL must be blocked by media-src 'self'