make sure api_key and api_secret are not required in unsigned upload