fix: force uploads to use auth headers instead of cookie

server/helpers/security.js

@@ -31,6 +31,10 @@ module.exports = {
       if (req && req.cookies) {
         token = req.cookies['jwt']
       }
+      // Force uploads to use Auth headers
+      if (req.path === '/u') {
+        return null
+      }
       return token
     }
   ])