Keep uploads outside the web root.

save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.

.env.example

@@ -13,3 +13,7 @@ RECAPTCHA_SECRET=
 
 # Google Analytics tracking ID. Leave it empty to turn analytics off.
 GOOGLE_ANALYTICS_ID=
+
+# Directory for uploaded images waiting to be saved. Keep it outside the
+# web root. The default is xxx-uploads in the system temporary directory.
+UPLOAD_DIR=