I'm a little worried about having no tests for this at all.  Couldn't we write a couple of specs to test the different possibilities associated with the PhotoController?  What it returns for logged users when the data is found in oracle, what it returns for logged users whose photo is not found in the db, whether or not we get a successful response, what happens in the case of failure, etc.