Feat/evap upload svc

* made some small improvements to evaporate provider.
* added some meat to the upload service.
* added some basic tests for upload service, other parts of upload not yet tested.
* use of uuid and env in prefixing upload file name
* additional headers for content type, disposition, and privacy
this should almost certainly be rejecting – I'd say pass `undefined` here so that the error isn't silently ignored.