Fix uploads failing due to CSRF protection

Need to send the form's CSRF value when sending POST requests.
Fixed parent-object virtual permissions

Leave it to the parent object (of DataObj::SubObject) to check virtual
permissions e.g. eprint/buffer/edit. Otherwise we end up doubling up the
virtual bit: eprint/buffer/buffer/edit.