Add routes to provide access control for upload.html file. Prefer a general solution in the /** route