public/non-public file upload access