Support deletion of photos (by owner only)

 - Correct auth check on all routes