Hi!
In order to get the node itself, SystemSession is the correct way, but files are a special case. You're not accessing the file itself using SystemSession, you only get the url to the file. The is fetched using a separate http request to the file, that is sent when the html is rendered in the users browser. In the html, there is no reference to the SystemSession, so the request to the file is interpreted as a anonymous request.
The solution is to use GetSecretUrl and build the image tag yourself. This returns a url similar to this one:
http://demosite/waf/Files/Content/323/-30902/a63a007a-972d-46ce-9c99-0a69d3970b16/_cached_120x0__40c789e6-6ac3-4ae6-9fbd-1ff88450f05e.jpg?r_n_d=624101_
Another benefit is that it isn't possible to alter the image parameters, so this is the only size they'll get access to.