From my tests, auth is required. 
  Even clearing the cache the image keep being
accessible... it seems
 them most as a browser related issue instead of an XWiki issue!! 
Is there a specific proxy, cache, reverse-proxy, load-balancer or SSL
accelerator between you and the website ?
Nicolas