check for null token in POST /photos