auth cleanup + ignore upload dir