scope photos users by perms