account/id/upload url secured with ROLE_TOKENSAVED