tinkering with file uploads, disabled iframe transport (use cors instead plz)