I think object-capability based access control would solve the problem as well. If the login screen is only given the capability to talk to the authentication program, then even if you could force opening photos, you wouldn't have the capabilities to hand to the photos app to actually view them.