The new "#privacy option" is now set by default. For plain #picture name URLs, set it to "no", if you want more protection, use strong.