[WIP] Move image path to the session scope.

[shohhei1126]

trafficstars

Work in progress for #1601

[jackycute]

Hi @shohhei1126,

Thanks for opening PR!

There is a use case that user uploads images in a note and later they like to reuse those image urls on the other platform (like external blog post or SNS) and those images will become inaccessible due to the session auth. This is the main reason why the uploaded images are public accessible by current design.