Adding some method security to controllers.

* added method security
* removed auth from services
* moved uploaded file validation from service to controller
* fixed some tests

Sorry for the huge big commit. Changes quickly became horribly
tangles and chopping them to several commits would have been
quite an operation.
Small typo fix.