postmessage scripts
combine login_required and authorize
change view url from /<profileid>/view/<imgname> to /view/<imgname>
fix auth
fix action_url placement
same interface to add/remove labels
better message on saving labels