Add photo display and config option to allow loading from filesystem blob

I suspect there's a better way to do this. Is it secure?