AWS uploaded files have public-read ACL

[willgraf]

All uploaded files have the public-read ACL. If this is not required, the file should not be public by default.

Originally posted by @ngreenwald in #84

[geneva-miller]

I think this used to be required so Fig8 could access uploaded images; it may not be required for caliban. I think it could be tested pretty easily by uploading a file without adding public-read ACL, and seeing if it can still be accessed through the browser app.