Feat/evap upload svc

* made some small improvements to evaporate provider.
* added some meat to the upload service.
* added some basic tests for upload service, other parts of upload not yet tested.
* use of uuid and env in prefixing upload file name
* additional headers for content type, disposition, and privacy
Does it make sense to have safeName as a method on Upload? It's purely functional, so I might leave it as a helper function scoped to the service.

It also looks like we call it a couple of times with the same input, so it might make sense to save it at construction time.