add one to many association between user and uploaded files
add tests to authorization admins