Added file upload URL to package create process.

Now return a signed upload URL for new package source when creating
a completely new package. Part of fix to issue #4.