Add server side form validation for the upload form

I think `empty()` is sufficient for both cases, that is, it is safe from unset warnings.