fix for upload_to, added names for urls for serving protected files