Bug: new Workhorse internal upload API rejects project and group avatars
Discovered in #1739 (comment 970396483)
Because this API is not yet relied on, users will not notice this bug.
The intended behavior of the new internal upload API for Workhorse is to reject unauthorized uploads early. However, avatar uploads for groups and projects appear to cause false positives. These requests happen very infrequently but they are supposed to work.