masking out uploads