if your PR doesn't pass I'm thinking of serving a files directory using apache like adding to the apache configuration something like
Listen 57220
<VirtualHost 127.0.0.1:57220>
ServerName localhost
DocumentRoot "/home/user/Pictures"
<Directory "/home/user/Pictures">
Options Indexes FollowSymLinks
AllowOverride All
Require local
</Directory>
</VirtualHost>
and then accessing the image using src="http://127.0.0.1:57220/icons/working.png", and because I'm using my own plugin to generate those src anyway, it's not a big problem to generate them on the fly. The question is how secure is it? Because I Require local, there should be no way of an attack from the same network? What do you think about it?