The current node.rb has no authorization in it, the fact upload is done as an unauthorized action. I wanted to preserve that behaviour, but couldn't find a better way of bypassing the API authorization layer