Only append cache_busting timestamp on public docs

Private document's thumbnails come from S3 with time-limited url and are already unique