allow file uploads to subdirectory only