You hit the issue right on:

Are you saying that upload() always succeeds with POST?

I tried to make it fail by passing it garbage file names. My understanding was that upload would return undef if it could not create a valid file-handle. And, if the file didn't exist, how could there be a valid file-handle? Instead, though, when I POST upload would return a string containing whatever string I passed in from the HTML form.

Now, I was able to validate by using either ->{Content-Type} or by using a regex to see if there was a directory trailing (not sure how many OS's do that, so I don't recommend it, but everything I tested did it).

My question remains, though: why is upload passing me that string instead of undef like the docs seem to say it will?