This can already be done with a reverse proxy and HTTP Basic authentication, but having it built-in would be nicer.

But then I'd have to give the password to anyone I wanted to receive files. I want to be able to send files to people but not have them be able to send to others.

Maybe adding HTTP basic auth is fine, as I mainly want to keep random bots from finding the service. I'll try that, thanks!

You can exclusively configure it on the upload page. It's not super nice, but it works.

I have not seen any bots on my public instance by the way. It has been running for more than a year.