allow passing an s3_acl to upload_request methods

Currently the acl defaults to 'public-read'

When generating upload requests, we should be able to pass `acl: 'authenticated-read'` or whatever to privatize the asset on s3.