we can't put pictures in the request body. so just return the SAS to the client for upload