Images are still allowed from http sources, but the rest is only allowed from self or from https domains.