abstracted a function to check whether a user is authorized to view picture