move upload to user controller