Don't require authenticity_token for uploads