Clean up & block direct access to /uploaded by user