File uploads - does S3 need to be publically accessible?

Thanks for catching this bug! Please do make a Pull Request, contributions are always welcome!

Iain