better handling of shock auth in ar-upload