Plain HTML form uploads; fuck JavaScript and CORS