Added reasoning/documentation about the plugin loader since it can trivially be done in another method and the method we used was because of perceived security implications.
Document the report_upload function.