Updated header in upload_form + added auth.js

Think simon accidentally remoed auth.js