Makes picture urls cacheable with CDNs like CloudFront

The security token applied to the picture show url will not translate well to CDNs like Amazon CloudFront because they ignore any query strings.

This commit places `param[:sh]` in the path before the file name.

`/pictures/90/show/file.png?sh=aksjdksjkjsj`

becomes

`/pictures/90/show/aksjdksjkjsj/file.png`