Loading course triggers web service request with no token

When loading a course, an HTTP request is triggered for the course's header image.  However, this request is made without a token, so the request fails, and triggers an exception in webservice/pluginfile.php.  This occurs even when using a custom course format.  We are seeing the following in our PHP logs as a result:

Default exception handler: A required parameter (token) was missing Debug: 

Error code: missingparam

* line 482 of /lib/setuplib.php: moodle_exception thrown

* line 573 of /lib/moodlelib.php: call to print_error()

* line 45 of /webservice/pluginfile.php: call to required_param()

Step to reproduce:

1. Visit https://mobileapp.moodledemo.net/ in chrome
2. Enter https://school.demo.moodle.net/ and log in as "student", password "moodle"
3. Click on Dashboard, and select the "Celebrating cultures" course.
4. Press F12 to open developer tools. Switch to the Network tab and clear the log.
5. Pull to refresh.
6. You will see a failed request for https://school.demo.moodle.net/webservice/pluginfile.php/1033/course/overviewfiles/diversity.jpg. Note that the URL does not include the web service token.