bucket upload now uses API auth