hiding collections from guest; clean-up of upload.xql

use security:get-user-credential-from-session()[1] instead of xmldb:get-current-user() (which returns guest even if logged in)