Picture uses a uuid for its id

UUIDs are nearly globally unique strings. By using them for the id for
our pictures, it makes it almost impossible for a malicious user to
guess the URL used to view a picture.

This lays the groundwork for allowing a guest to view a picture shared
with them by the pictures owner
Guest may view a picture

By making the picture show a nested resource, we ensure a user must have
access to both the users id and the pictures id before they can access
a picture.

Sure, this makes the URL pretty long, but it also protects our users a
bit from accidenal image discovery.
Make it more obvious how to share a picture

Doin' some Interaction Design here. Makin' things findable.

Yep.
Merge pull request #4 from codeunion/guest-may-view-users-image

Guest may view users image