force login
file upload