app: check auth credentials from POST-data
app: handle incoming parameter 'pict_type'