Improved permissions wrt file upload
Cleaned up an edge case where user is dropping a non-file