decided to forget serverside auth and use clientside auth only to get images + use web service to store/receive image urls from users through ajax