adds upload functionality, moved credentials to env variables, but still need to tie a manifest to a specific session
persists manifest file throughout session
adds flash for error on bad manifest upload and manifests#new is now the loadmanifest link; no longer staticpages#loadmanifest