Feature 5425 / thumbnail: rewrite - secure thumbnails are now rendered on first access, not when 'AS _thumbnail' is called.