user only uploads if logged in