Jump into a D&D tabletop session with your friends, hassle free. Tabletopper.app
/assets/images/{id}, /assets/images/{id}/preview and the map tiles under /assets/maps/{id}/tiles/ need a signed-in session but do not check who owns the asset. That is deliberate: players in a room load the GM's maps, tokens and monster images without being granted each one. The asset's ULID is the capability, so anyone signed in who holds the URL can load the image.