removed access token from POST upload