The rails before_filter concept maps closely to the middleware concept from connect, which is part of express. You can set this up manually by preceding each photo related route with your authentication function, or use something high-level like TJ has mentioned. To do it manually would just be a matter of something like this (pseudo-coffeescript)
myAuthMiddleware = (req, res, next) ->
if not req.session.user?
res.redirect "/"
else
next()
editPhoto = (req, res) ->
....
deletePhoto = (req, res) ->
....
app.use(myAuthMiddleware, func) for func in [editPhoto, deletePhoto]
What that is saying is use myAuthMiddleware like a before_filter for the editPhoto and deletePhoto middleware functions.