Thread:Project:Support desk/viewing image requires login after locking down * read to false/reply (2)

This sounds like the intended behavior (other than that doc and txt files shouldn't be being exempted).