> You might want to check which urls are accessible without login

Hm, I don't need to check, because I suppose the images are always requested without user credentials. That's why I think letting the HTTP-server deal it is the best way.
I can see two options now:
* saving the images in a "public" data directory
* saving the images in the standard data directory and serving via AppFramework response (optionally providing advice in the wiki how to configure the HTTP-server to handle the image requests)