Allow security disabling in Upload class for unit testing purposes (#4751)