add some extra access control to some endpoints, and change csv url to tie up with names used by init scripts
minor bug fix on setting spreadsheet name, and remove all bulk uploads on run