/upload now also returns a 403 when not logged in.