prevented guest users from seeing /upload