require secret key for upload - closes #2