media masking server: POST /mask for images, POST /mask-text for text