add authorisation to uploading