Added docs on CSP rules needed for using cdvfile in DOM src. This closes apache#120

Author: daserge

README.md

@@ -406,10 +406,21 @@ which can be used to identify the file uniquely.
 
 `cdvfile://localhost/persistent|temporary|another-fs-root*/path/to/file` can be used for platform-independent file paths. 
 cdvfile paths are supported by core plugins - for example you can download an mp3 file to cdvfile-path via `cordova-plugin-file-transfer` and play it via `cordova-plugin-media`.
-To use `cdvfile` as a tag' `src` you should convert it to native path via `toURL()` method of the resolved fileEntry, which you can get via `resolveLocalFileSystemURL` - see examples below.
 
 __*Note__: See [Where to Store Files](#where-to-store-files), [File System Layouts](#file-system-layouts) and [Configuring the Plugin](#configuring-the-plugin-optional) for more details about available fs roots.
 
+To use `cdvfile` as a tag' `src` you can convert it to native path via `toURL()` method of the resolved fileEntry, which you can get via `resolveLocalFileSystemURL` - see examples below.
+
+You can also use `cdvfile://` paths directly in the DOM, for example:
+```HTML
+<img src="cdvfile://localhost/persistent/img/logo.png" />
+```
+
+__*Note__: This method requires following Content Security rules updates:
+* Add `cdvfile:` scheme to `Content-Security-Policy` meta tag of the index page, e.g.:
+  - `<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: `**cdvfile:**` https://ssl.gstatic.com 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *">`
+* Add `<access origin="cdvfile://*" />` to `config.xml`.
+
 **Converting cdvfile:// to native path**
 
 ```javascript