Upload files testing & improvements

this should use the injected $account, so it works with token auth as-well.