allowed file uploads only on certain routes with a custom middleware