securing uploaded files, not longer in public