I expected to see "Folder Tools" > "Upload or Link to File" but did not:
I checked that the back-end does say that the user can upload and can 'add child':
Update: When I tried to create a file programatically I got:
But the object IS created, meaning that the client tries to update after creating.
So if we want clients to be able to create but not update objects in a folder we have to change multiple clients.
This is related to CHL-14.