Added access check - not really necesssary because we're only doing a

redirect, but it's nice to be consistent.  Follow-on for #1837.

modules/image_block/controllers/image_block.php

@@ -20,6 +20,7 @@
 class Image_Block_Controller extends Controller {
   public function random($item_id) {
     $item = ORM::factory("item", $item_id);
+    access::required("view", $item);
     item::set_display_context_callback("Albums_Controller::get_display_context");
     url::redirect($item->abs_url());
   }