moved upload logic into routes