session_id query string removed for uploader - security fix