Use bearer_token for images; no longer need to webauth.