I found my issue:
Remember that images are handled by post-back to YOUR web-site.
I was using forms-based security, and my own security system... the web requet for the image was be denied by my internal security -
if your application is using security, remember this request will pass through normal security too - allow for this, and your problem may be solved too.
... david ...