Using OAuth 1.0A and the recipient or sending user’s access token (or an session-authenticated webview) is the only way.
The images are not meant to be displayed to any other user besides the sender or recipient and should generally not be used for other purposes.