otc uploads (not via curl) b/c of encryption