file upload now uses an InputStream