Turns out the allowed_files and required_files attributes are only used in the browser for pre-validating the uploads.