fix gaping security hole in fixture upload