users can upload files and only they can view them