I had similar issues - I ended up using the RadUpload control inside a radwindow
as my company nor I liked the fact of explicitly adding permissions to the app_data folder (Just one more configuration for production builds). (windows authentication)
The radwindow handles the page refresh just fine. If your impersonating a user, make sure to wrap the save, TargetPhysicalFolder, pretty much everything in your save event inside a token
* Also make sure to clear the TargetPhysicalFolder path in somewhere like onprerender of the control. If you don't and your using windows authentication, your going to notice it tries to use the windows authenticated user the second time around as it's set now and the Event for attaching will not even fire.
You can use process monitor
to help in permissions.