Display validation errors in UI

@dangoor 

Also snuck in a bug fix: don't allow someone to directly hit `/upload` without being logged in.

Note that this doesn't yet allow for localization of the strings--I'll file an issue about this since it's not obvious what the right approach is.