allowing upload policy either in JSON or base64