Yes,
year are right, the policy setup for images was strange. i have changed the default policy (policy1) to require the same permissions (i.e. no permissions) to view a page and do a download/view an image. Before, there was no permission checking on view page, but it required read permissions for the user (and therefore a login) on images.
This is changed in CVS head and should fix the problem
-gustaf neumann
