it does not need to be included in the delete or update behavior.
the page that populates the delete or update pages uses a recordset to populate the page with the record to be deleted or updated.
this recordset should have the extra where condition to compare the session variable.
use a show if behavior to hide the delete or update form if the recordset is empty.
this way the delete cannot happen if it is for an image that does not belong to them