Review fixes. Move upload endpoint out of server.js