This API endpoint is unsafe, anyone can update any thumbnail using it. We should instruct the mediacore callback URL to come with a signature so we can verify it.

Also I think we need some CSRF handling since this is a POST originating from outside the system. An example of this is in the handling of the Shibboleth POST-back: https://github.com/oaeproject/Hilary/blob/master/node_modules/oae-authentication/lib/strategies/shibboleth/rest.js#L28