guard against forgotten file upload