shared secret auth for image upload