* move parameter normalization back to controller, because this is
  frontend-specific.
* if the StatusMessage is public, save also public photos