You are correct that the destination path can be changed in the case of http uploads. For now this isn't a destructive problem since there is no overwrite on uploads, but this will be given a high priority. We would need to add the path as part of the the token generation. The only way to avoid this...