Harden image download in Canvas AI.
Permission should have restrict access flag.
Security fix
Fixes #3575516: Fix XSS issue in Tagify autocomplete and select widget JavaScript (a security issue).
This release fixes a security vulnerability.
Security fix for a XSRF vulnerability.
