upload proteceted & hybrid auth