[bug]user can access private photo by changing cards id
Merge pull request #121 from peterzd/fix_photo_privacy

[bug]user can access private photo by changing cards id