got validating and uploading to S3 with secure name
refactored controller, emails sends after validation
fixed conflict. use card.photo.url now