Requests for images are no different than requests for any other URL.

POST requests can also be forged, though not as secretly.