applied authorization to "photos#new"