ensure upload controller honours file upload permissions