upload vs csrf