WebView, WebEngine CORS headers and file loading in SFOS >= 4.4

Nono, I have a backend which spits out a HTML string. That HTML contains regular <img src="foo.png" /> elements.
The image files lie in ~/.cache/foo/bar.

I use WebView::loadHtml to display the html string which works fine. Only the images are not displayed, no matter what I do.

Using MOZ_LOG magic I can see the images are found, it begins to load them, and finally

D/imgRequest [this=7d4907cac0] imgLoader::LoadImage -- AsyncOpen() failed: 0x805303f4

Where afaics 0x805303f4 == NS_ERROR_DOM_BAD_URI is an error due to CORS/CSP denying the load.