combine uploadID and secret to validate URL