revert security in photos_controller