upload requires login. saves to correct dir