remove auth_token from GET calls for images

[jshslsky]

Having the auth_token in the URL is bad because someone can right-click and copy the link or click the image and see the auth_token in the address bar.