In special cases, access tokens can be bypassed

In a very special case, original images (as in images with no transformations) can be viewed without any access tokens.

If the server admin has configured the `Imbo\EventListener\AccessToken` event listener with a whitelist and/or a blacklist of transformations, requests against the image resource that does not include any transformations at all in the request is allowed.