You might want to make it more obvious that pictures aren't linkable by doing something like returning the image from a POST (might make for bad UI) or returning the image as a data url.