GRP-1025: allow any grouper external public images (e.g. institution
logos) through csrf