Increase default image proxy secret's length to 20

Additional security, fixes #2507

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Ensure we're serving an image via image proxy

Although this isn't technically a hole since that'd require a hole in PHP's JSON implementation, better be safe than sorry

Signed-off-by: Shitiz Garg <mail@dragooon.net>