allow upload file://..., but only in direct_upload_paths