added private methods to photos_controller for authorization purpose