added some tests for uploads

- [x] initial tests for `upload.rb` model
- [x] validate server-side that the user is uploading an image (through its mime/type)
- [x] changed the first `Upload.create_for` parameter from `user` to `user_id`