refactoring shock and lock codes

1. upload auth behavior now depends on shock configuration
2. support input data specified with authenticated shock URL 
3. remove some race conditions