Unsure whether this is actually an issue- but- I don't think you do auth right on multipart uploads? I think anyone can upload and overwrite parts if they have the UUID for the upload_id?