add check m_auth, fix photo show api