If it is two separeted workflows, remember to ensure workflow order. After reading this thread I linked, I do everything using custom workflows and page states to manage the correct order of execution.
Looks like you are doing everyting right, I guess that your image uploader is with “make this file private” checked and attached to the thing of the user, not to the user itself, because you got a safe link too, the one in “yourapp” domain.
I’m doing something very similar to yours using custom workflows.
Yeah, I agree.