get rid of legacy hack
handle file uploads