don't flash on xhr
show uploads and originals only for authenticated users