security update
.btn-danger will launch a confirm modal
Photos actions restricted to owner
general purpose restrict_to_owner($obj_id) added to AppController