When a user accesses a PO through the portal thanks to an access token (without being connected), the product image on each order line is rendered using the image placeholder with a size of 48x48. This raises a 403 Forbidden at image retrieval since the access token is not passed as a parameter. This commit corrects that behavior by sending the resized image along with the rendering of the template instead of an url. Another solution could be to generalize the access token check to any model in: https://github.com/odoo/odoo/blob/12.0/odoo/addons/base/models/ir_http.py#L303-L311 But this seems overkill regarding this specific error. opw-1902741 closes odoo/odoo#28479