With private uploads, strange error in 2.8 that isn't in 2.0

Image does not load and 403, even when logged in (in Chrome)

```
GET http://t-pen.org/TPEN/imageResize?folioNum=13240356&height=2000&user=cubap@slu.edu 403 (Forbidden)
Image (async)
loadTranscriptionCanvas @ transcribe.js:1577
success @ transcribe.js:926
fire @ jquery.js:3143
fireWith @ jquery.js:3255
done @ jquery.js:9309
callback @ jquery.js:9713
XMLHttpRequest.send (async)
send @ jquery.js:9659
ajax @ jquery.js:9210
loadTranscription @ transcribe.js:860
success @ transcription.html?&projectID=6630:873
fire @ jquery.js:3143
fireWith @ jquery.js:3255
done @ jquery.js:9309
callback @ jquery.js:9713
XMLHttpRequest.send (async)
send @ jquery.js:9659
ajax @ jquery.js:9210
(anonymous) @ transcription.html?&projectID=6630:859
dispatch @ jquery.js:4665
elemData.handle @ jquery.js:4333
load (async)
add @ jquery.js:4383
(anonymous) @ jquery.js:5244
each @ jquery.js:384
each @ jquery.js:136
on @ jquery.js:5243
(anonymous) @ transcription.html?&projectID=6630:849
Cross-Origin Read Blocking (CORB) blocked cross-origin response http://t-pen.org/TPEN/imageResize?folioNum=13240356&height=2000&user=cubap@slu.edu with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.

Start by reproducing the 403 for a logged-in user with a private upload, using the imageResize request shown in the report. Trace the call from transcribe.js, especially loadTranscriptionCanvas and loadTranscription, and compare the behavior with version 2.0. Done means the private image loads successfully for an authorized user without the reported 403.

Written by the indexing model from the issue text.