Don't require volume in uploadStart

Didn't actually provide any security since anyone can create a volume;
makes front-end simpler by eliminating context.