ok, in your schema, they wouldn't be allowed to call "uploadphoto" from "facebook"