Add picture url column, and before filter to require login for create