Protecting /upload

Of course I tried to send JWT with the request although I’ve turned public access to the upload plugin but still…