Moved image handling to diff controller since it doesn't support the csrf header, need to test more in an hour (WIP)