allow unauthed users to see photos