made photo deletion secure against csrf