Something I have noticed with Facebook logins: the more permissions you ask for the less people will use it. A permissions access box with 5 items is more likely to be aborted than one with 2 items.
Also you already mentioned the risk of users feeling the site is intruding on their privacy by showing a picture
So the question then becomes, is the benefit of showing a picture greater than the risks that come with it. The risks are stated above, so what about the benefits? "showing the customer that she is properly logged in", If this is the benefit we are trying to go after I think a clear "you are logged in" state is all that is needed. In fact I would not even show a name necessarily because that could be considered a privacy violation. Showing it raises all sorts of other questions for the user too: Who else can see this photo? is my name tied to what I am buying? how do I change this information? what other information did you pull from my profile?
In other words if the simple goal is just to confirm that the user is logged in there are methods that carry a lot less risk than showing a real name and real photo. Usually the benefit of showing a photo is when that photo will be used for a functionality on the website (think public user profile, social site, dating site, ect).