move controller logic to controller.js
update hoax to a version with exposed pax
photos appear in chats