Adding the permissions in the App Settings is for the App Centre only, the permissions will actually be asked in the app only if you add them in your login code.
So, replace-
$loginUrl = $facebook->getLoginUrl();
with-
$params = array(
'scope' => 'user_photos'
);
$loginUrl = $facebook->getLoginUrl($params);