add max_size check for file uploads