Good catch. Maybe the best thing to do is remove the write scope requirement: the upload action is only allowable by admins (that is, user/client with cloud_controller.admin scope), so the write scope is irrelevant.

I'm going to make another commit that take outs the write scope requirement. In that case, do you think it's important to include a test for case that the user has write scope but not read scope? It seems like that might be superfluous.