sandboxing file upload with webapi