[Audit] blitz: /upload returns Content-Length header instead of actually reading body