set permissions on file uploads