Add upload_pic route, closes gh-439