fixed bug so that upload is also allowed for user with temporary credentials