Just saw it. You are absolutely right. My bad... Will fix it tomorrow.
Now the strange thing: thumbor requires cookies in order to serve images. It requires quite lax settings since allowing cookies for thumborg.org as first party only doesn't suffice. I need to accept all possible cookies, I think because one offending cookie has domain .thumborg.org.
I think serving images should not depend on cookies, or is there a good reason?