In the html view, images are displayed like this:
element.image.url points to a
element.image.url
I am facing the same problem. The best solution I found is passing the Authorization token as a query parameter.
For example :
This way you can secure those images only for your REST consumers.