users can only delete their own photos - via Cancan gem