Move /upload endpoint to DRF, accept Session Cookie or HTTP Basic or JWT.

Add setting to config.yml to optionally allow unauthenticated uploads.