authenticated image attachments