authorize ImagesController actions