diff --git a/rpc.js b/rpc.js
index 8be2f1df8..d3b81647a 100644
--- a/rpc.js
+++ b/rpc.js
@@ -84,6 +84,7 @@ var unescapeKeyCharacters = function (key) {
     return key.replace(/\-/g, '/');
 };
 
+//  TODO Rename to getSession ?
 var beginSession = function (Sessions, key) {
     var safeKey = escapeKeyCharacters(key);
     if (Sessions[safeKey]) {
@@ -625,6 +626,7 @@ var makeFileStream = function (root, id, cb) {
             var stream = Fs.createWriteStream(full, {
                 flags: 'a',
                 encoding: 'binary',
+                highWaterMark: Math.pow(2, 16),
             });
             stream.on('open', function () {
                 cb(void 0, stream);
@@ -637,12 +639,15 @@ var makeFileStream = function (root, id, cb) {
 
 var upload = function (Env, publicKey, content, cb) {
     var paths = Env.paths;
-    var dec = new Buffer(Nacl.util.decodeBase64(content)); // jshint ignore:line
+    var dec;
+    try { dec = Buffer.from(content, 'base64'); }
+    catch (e) { return void cb(e); }
     var len = dec.length;
 
     var session = beginSession(Env.Sessions, publicKey);
 
-    if (typeof(session.currentUploadSize) !== 'number') {
+    if (typeof(session.currentUploadSize) !== 'number' ||
+        typeof(session.currentUploadSize) !== 'number') {
         // improperly initialized... maybe they didn't check before uploading?
         // reject it, just in case
         return cb('NOT_READY');
@@ -670,6 +675,12 @@ var upload = function (Env, publicKey, content, cb) {
 
 var upload_cancel = function (Env, publicKey, cb) {
     var paths = Env.paths;
+
+    var session = beginSession(Env.Sessions, publicKey);
+    delete session.currentUploadSize;
+    delete session.pendingUploadSize;
+    if (session.blobstage) { session.blobstage.close(); }
+
     var path = makeFilePath(paths.staging, publicKey);
     if (!path) {
         console.log(paths.staging, publicKey);
@@ -797,7 +808,7 @@ var isAuthenticatedCall = function (call) {
         'UPDATE_LIMITS',
         'GET_LIMIT',
         'GET_MULTIPLE_FILE_SIZE',
-        'UPLOAD',
+        //'UPLOAD',
         'UPLOAD_COMPLETE',
         'UPLOAD_CANCEL',
     ].indexOf(call) !== -1;
diff --git a/www/common/rpc.js b/www/common/rpc.js
index 45fe1eaec..a39e410dd 100644
--- a/www/common/rpc.js
+++ b/www/common/rpc.js
@@ -129,6 +129,24 @@ types of messages:
             return sendMsg(ctx, data, cb);
         };
 
+        send.unauthenticated = function (type, msg, cb) {
+            if (!ctx.connected) {
+                return void window.setTimeout(function () {
+                    cb('DISCONNECTED');
+                });
+            }
+
+            // construct an unsigned message
+            var data = [null, edPublicKey, null, type, msg];
+            if (ctx.cookie && ctx.cookie.join) {
+                data[2] = ctx.cookie.join('|');
+            } else {
+                data[2] = ctx.cookie;
+            }
+
+            return sendMsg(ctx, data, cb);
+        };
+
         network.on('message', function (msg) {
             onMsg(ctx, msg);
         });
diff --git a/www/file/main.js b/www/file/main.js
index 0c5e8f3a1..8d582a183 100644
--- a/www/file/main.js
+++ b/www/file/main.js
@@ -65,7 +65,7 @@ define([
             var enc = Nacl.util.encodeBase64(box);
 
             chunks.push(box);
-            Cryptpad.rpc.send('UPLOAD', enc, function (e, msg) {
+            Cryptpad.rpc.send.unauthenticated('UPLOAD', enc, function (e, msg) {
                 console.log(box);
                 cb(e, msg);
             });