Secure the uploads out of the public folder
content type passed in the header