add auth_token to image upload endpoint