Sanitize submission filename

It turns out werkzeug has a secure_filename function, so I just ran the upload filename through that. 

Seems to do what we want. "../" is removed and "/" is replaced with "_".

Also moved some stuff around and added a dependency on "mock" for testing.