upload() rewritten to reduce binding and pyramid of doom