handle upload (backend)