Only obfuscate upload URLs if access is not for everyone