Don't allow upload if not logged in (if someone tries to POST directly)