Since the path seems to be optional (which makes sense for custom controllers or fixed paths) and the session.uploadr only gets initialized if the path is received, the session.uploadr access must be null-safe