tweak upload auth flow