Fix a security vulnerability where the user password hash would be sent by the server

Images are showed right after uploading without refreshing the browser
URLs to image assets are resolved when getting the settings from database table
404 page now gets the user settings too