registration: don't attach user to picture.
api middleware: don't touch non-api responses.