more robust upload form