Provide acl in headers rather than form data?

[danielcompton]

I was confused for a bit trying to debug why "PutObject" permissions weren't enough to put an object to S3. At first I thought I needed "PutObject", but after reading the docs, it says "PutObject" is only needed for adding acl's to existing objects. I tried it anyway and it worked.

After reading "PutObject" REST docs, I couldn't see anywhere that it showed passing acl as a form parameter, they suggest adding it as a header.

This needs more investigation.

[danielcompton]

We do a POST, not a PUT, and the acl is a form parameter in the POST. (http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html)