Stop JSHint from complaining about Promise.

It doesn’t exist yet, and we’ll continue to use bluebird regardless.
Simplify upload process.

This allows one upload to be performed at a time, relies on hashes for
unpredictability instead of associating media with users, and moves
permissions and streams handling out of controllers.