Serve private files and image deriviatives by pin

#4084 

This fixes the remaining issues with serving private images and derivatives when private by pin is selected.