I think you're right. I also think the browser, as your agent, should enforce expectations. "This website wants to upload data. Allow? [Once] [Always] [No] [Click here to see the data.]"