finished before_action authenticate_user and validation for pictures