All (raw) image endpoints in ImageByNameController, ImageController & RemoteImageController are unauthenticated

• This allows probing on whether a specific image exists on the server by guessing item id’s (which can be done without too much trouble, as item ids are based on filepath and filename information) and then checking on what content (movies, series etc) exist on a given server, without having an account.

https://github.com/jellyfin/jellyfin/issues/5415

I’ll be sticking to Plex until it is reasonably safe to expose JF.

I am not anti socialism, but is this not a privately owned company, just doing something nice? People don’t own the booths, they’re just allowed to use them for free, for now.