Feat/evap upload svc

* made some small improvements to evaporate provider.
* added some meat to the upload service.
* added some basic tests for upload service, other parts of upload not yet tested.
* use of uuid and env in prefixing upload file name
* additional headers for content type, disposition, and privacy
I think that leaving this as private (which we know we ultimately want) is appropriate – we can just use the HTML5 File object for the demo.