upload: handle filenames with spaces