authenticate once for all uploads