notifications route; added middleware.authenticate to user/uploadpicture api route