ajax deleting photos, appropriate can-can ability