thruk_auth: allow images