fixed creation of file upload, added authorization while file access