GRP-1025 allow any grouper external public images (e.g. institution
logos) through csrf