auth-protected and admin interface enabled upload