anyone can find the authentication endpoint from the sourcecode and then get the token for image upload