Add note about also requiring access token in file upload header