An editable link grants an upload session, a view only link answers 404. The
returned endpoint is not reachable from outside: CreateUploadSession hands
out the internal data server url, for authenticated callers just the same,
so the byte transfer stays with the graph upload work.