when uploading files, check auth, set user and return detailed object