Remove public_url and assume secure_url for now

This is in preparation for a state machine on photo + we don't need to store the public url, it can be calculated cheaply (concat a few strings).