accessible_by to a single string instead of array. uploaded_by no longer required, automatically filled to user that uploads anyway