moving other methods from User and Picture to application controller after privs. have been moved to session cookie.