Status: Go horse.
You used token based auth and you need to serve images from secured routes.
Use http-src instead of ng-src and it will fetch images using the $http service - meaning Authorization headers added via interceptors will be present - then build a Blob and set the src to an objectURL.