Since upgrading to the latest Angular 2 release candidate, my img tags:
img
Either you can expose sanitizer to the view, or expose a method that forwards the call to bypassSecurityTrustUrl