Replaces reading list cover image and locks it with a base64 encoded image

This is the only API that can be called by non-admins, but the authenticated user must have a readinglist permission