return download_url to images that does not require auth