Form builder upload improvements

[carbsrule]

@TheJosh says:

• [ ] Support storing files in protected storage (i.e. they can't be accessed via a public URL like http://server/files/form_submissions/* with no authentication)
• [ ] Do something about images with giant dimensions -- they are probably OK; we just can't show a thumbnail preview because the server will run out of memory if it attempts to do so.