add web/upload ACL to handle thumbnail generation