Fix issuer image access.

Fixes #243 

Add `/issuer/image/*` to the auth whitelist.