added a permission class to fileuploadapi