basic image upload, client side only