moved upload route into API namespace