[chore]add authorization for photo show and download action