I figure we can get even better messages than "Access denied" in case this happens again!
Also, I need a new deployment to trigger the new env vars, so why not make it count? :)
My hypothesis is that this missing `await` is causing prod Vercel to cut off the request before the async upload finishes. Omitting this `await` was a mistake, so I'm just adding it right in!
I also add logging for the success case. That way, if this isn't actually a fix, I can at least watch the logs and confirm whether the app thinks it's getting to here.
