keep out non-admins from upload_page