photos require authentication