Add "hash" field to /api/{upload,status}