AnimalPictureController cleanup.

- formatted, organized imports
- added PreAuthorize-annotations where needed
- moved redirect String to Routes, use placeholder instead of gluing
  the picture id with String concatenation