Allowed image action in Auth (if Auth is enabled)