if your PR doesn't pass I'm thinking of serving a files directory using apache like adding to the apache configuration something like

Listen 57220

<VirtualHost 127.0.0.1:57220>
    ServerName localhost
    DocumentRoot "/home/user/Pictures"
    <Directory "/home/user/Pictures">
        Options Indexes FollowSymLinks
        AllowOverride All
        Require local
    </Directory>
</VirtualHost>

and then accessing the image using src="http://127.0.0.1:57220/icons/working.png", and because I'm using my own plugin to generate those src anyway, it's not a big problem to generate them on the fly. The question is how secure is it? Because I Require local, there should be no way of an attack from the same network? What do you think about it?