file upload location fix, change policy to session only & general cleanup