core: prevent leakage of query args from one transport to the next. Ensure query validation.
core: use transport for moving the upload progress to the browser.