Use norm package identifier instead of package identifier at package upload time. Reject duplicates. closes #500