Block XHR file upload requests without content disposition header

There are some WAFs which depend on the existence of the content disposition header in the body of a file upload to recognize that it is actually a file-upload. Currently the Vaadin FileUploadHandler will accept both, uploads with and without the content disposition header. For security reasons file uploads without the header should be blocked from the Vaadin server as we want to ensure that the WAF scannes the file uploaded. Just check the URL-pattern /APP/UPLOAD/** is not enough as our WAF just ignores uploads without the header.

As some of the components rely on that mechanism a configuration for that might be a good solution.

Side Node:
XHR2 introduces the FormData JS object which makes it easy on most current browser to add the headers on client side (http://caniuse.com/#search=XHR2).

Start with Vaadin's FileUploadHandler and the /APP/UPLOAD/** request path, then inspect how uploads are currently accepted with or without a content disposition header. Determine how the requested configuration should interact with components that rely on this mechanism; done means headerless uploads can be blocked while supported uploads continue to work.