Ah, I see. I guess we can hide this from people using the sandbox by putting the base64 encoding stuff in `HttpApi` when we add multipart support to the toolkit.