replaced fs.writeFile(photo) into the upload request callback, so it has access to photoId