Direct CORS uploads to S3.