The access_token is automatically added by the media editor. It's added on the website and by the html editor to send by email. The widget display the attachments from 'ir.ui.view' (public attachment) and the attachment from the current record. Issue: can't load image in gmail or mobile because the client mail use a proxy who avoid ours odoo access.