QSD media: various changes

Some changes to QSD media:

* Delete files on disk when object is removed (Django 1.3 did this automatically, but no longer)
* Use randomized filenames instead of hashing the original filename
* Support /download/randfilename/actualfilename URL's
* Implement restricted filenames list to prevent XSS attacks