Add working image upload.
Enforce login.
Persist credentials between activations