reject too-large packaged app uploads early with 413. (bug 861516)
move a couple more things into fireplace/ (bug 875536)
move shared secret to authorization header (bug 870976)