Fixes for upload permissions

This takes care of permissions for seeing the upload button.
@rossriley Can you do a merge upstream? This PR would undo #2324 otherwise.