add upload directory
use constant-time string comparison for secure comparisons, require php>=5.6
refine match() function in models