adding user_photos in permissions