upload.html updated with preview. Password working with pid in url