Allow private images to be returned as thumbnails. Client-side error handling for now. Closes #38.