ensure upload controller honours permissions
set the form to false if no permissions
use statements
hide ui
hide ui for files too
leave the add to stack button in place
allow editor to upload files
do not show upload if not allowed
mock the users object so that tests can run without permissions
Merge pull request #2322 from rossriley/upload-permissions-fix

ensure upload controller honours file upload permissions