image uploader and some role based auth