Feat/evap upload svc

* made some small improvements to evaporate provider.
* added some meat to the upload service.
* added some basic tests for upload service, other parts of upload not yet tested.
* use of uuid and env in prefixing upload file name
* additional headers for content type, disposition, and privacy
I don't think we'll ever be linking directly to images in a way which will make this inappropriate. To be honest, it seems likely that we won't be serving anything out of the staging "uploads" bucket until fairly far down the line, but this seems like what we want for *all* of our uploads anyway.