upload permissions decorator made ajax-safe