Set security for /api/images.
Small update.
Update. Set token header to ajax.
Small updates.