hidden photo upload from non admin users