only allow POST to /upload