But the actual image data isn't stored in the token, just its URL (usually). So what you own is not the image, but rather, whatever resource resides at a particular URL, with there being no guarantee that that resource doesn't also live at some other URL.