separate public/private GET info routes

also fix upload input bug