Identification code and img src property

These two items are unrelated. The attribute id just uniquely identify any HTML element. It's main use is getting an HTML DOM object by the value of id, by JavaScript:

myElement = document.getElementById(idValue);

Now, about src attribute. Why it is not an image file? Just because it does not have to be. First of all, HTTP servers can use index files and other URI-related techniques which hide the real image file. I will explain only one case, the index file. Actually, that URI can be the virtual directory name (it is incorrect though, please see below). In this directory on the server side, you could have a file recognized as index file by its name pattern, such as index.html, index.htm and the like (the rule for index file name is configurable). So, actually, this could be the image file, but you cannot see it from the URI. Moreover, it does not have to be an image file. If could be the server-side script file which sets the HTTP header of appropriate MIME type, such as "image/jpeg", "image/png".

Here, you should understand that for a Web browser, the file name of file type plays the minimal role. Actual MIME type is sent to the browser in the "content-type" HTML header. Please see:
http://en.wikipedia.org/wiki/MIME[^],
http://www.iana.org/assignments/media-types/image[^],
http://en.wikipedia.org/wiki/Content-type[^].

And finally, I need to explain what's wrong with src="/ipcast_os/login_auth/display_verify". This is a really bad URI, and it can be invalid. Here is the thing: HTTP server should access only those file of the server host's file system which are placed in the directories under the root directory configured for the site. This is a matter of very basic safety. This URI starts from the root directory of the file system; look at the leading '/' symbol. There are no cases where the use of absolute local server's file system path can be useful. Imagine that this file path is valid; it is located under the site's root. But what if you decide to relocate the site? It could be done by the hosting provider, without notifying you; and this would be quite a legitimate action. All your site may be destroyed into inconsistent state. The URIs should be either relative, or based on Internet scheme such as "http://", "ftp://", "https://", etc. In this case, the directory path will be the path relative to the site's root directory.

See also: http://en.wikipedia.org/wiki/URI_scheme[^].

—SA