set UPLOAD_DASHBOARD_URL directly, update to secure vars later.