Make it clear image fetches in the spec are uncredentialed #779
Description
In particular, the RP/IDP branding ones need to be uncredentialed to avoid leaking info before the user has gone through the flow. Thanks to @will-bartlett for pointing it out