upload_url shouldn't use path.join