Trim down users and photos routes to read only ones