for upload, issue an empty POST (Bad Request) first to get the credentials and not...