added JS to append session_id to query string on hrefs. changed upload page to retrieve user_id form the session, and tested that OpenERP group policy works with current user.
upload_document changed to use session_id instead of newSession().
Added vendor_id field to stock.move and changed code to use it for matching session user to partner.