only check image upload because download requires authentication