admin tests work but needs heavy refactoring and basic auth. better photo removal methods