Miscellaneous bug fixes.

Add Allow-Origin to default headers on upload handler.
Return data rather than file object from upload task to fix
serialization.