TODO  security,user management-partial  -on click upload