Upload should not be accessible for unauthenticated users neither in the client, nor on the server