don't store img server side, returns base64 encoded img buffer