Image proxy security improvements

Increase default hash length and ensure we're serving an image, fixes #2507