Allow to just request default profile. Set usual site id and by default lock down backend access.
Attach a file by drag & drop or click to upload
