FIX: upload image auth