remove authorization for getPhoto method