[DO NOT MERGE] 957 xls report upload

- the only bits left before this is mergeable is to do ui cleanup when a file is upload
should this link be available to everyone? I think at least anonymous users should not see the upload window. Please add code and a test verify that it is hidden for anonymous users.