Make the image proxy a little stricter
- Only allow certain content types and require auth.

Fixes #643
Fixes #642