(bug 18394) img_auth.php now respects userCan