a user now needs to login before uploading