images are public if uploaded by admin