Insecure CSV upload

CSV fiels are uploaded to the default media storage without any authentication.

Filenames are replaced with a random UUID, but that is not enoughto protect such sensitive information.