restrict access to ds uploader