Added permission check to file upload and fixed bug with getting single expression by ID.