How about returning a pick_n_url for each of a user's pictures in results of a login mode request.
Pros:
- allows clients to access the pictures.
- unlikely to upset any existing clients
Cons:
- extra bandwidth usage from clients downloading the pics.
- extra cruft in the login mode