Update S3 bucket functionality so that files are not all public

[jamesjefferies]

Currently, using the pre-signed post functionality, all files which are pushed to S3 are on the public ACL (access control list) - while it is unlikely they can be 'found', it makes sense to limit access to S3 file from the application itself. This will involve some refactoring and using the S3 API rather than simply reading public URLs.