Minimal implementation of csv upload.

embedding the content type in the uri seems wrong to me. It's certainly not in the spirit of hateos.

I didn't know about the requirement to download csv again, but my intention was that the upload will return 202 - Accepted with a Location header. The user then polls that location uri and eventually they get a 200 returning a 'report' on the success of their upload (or otherwise). I was expecting the success reports to be at /4/uploads/ - user can see all the uploads they're allowed to see (ie. get an index) or download a specific 'upload' report.