fixed user security handling when showing public or private albums