raw_image/<id> should not be accessible to _every_ logged in user

At the moment the raw/original image can be access by every logged in person, this poses a bit of a security leak. Eg. https://avatars.linux-kernel.at/accounts/raw_image/12