Carrierwave debt

Tracker: https://www.pivotaltracker.com/story/show/42490007

Main points:

* CarrierWave uploads now use the same storage mechanism in all environments.
* CarrierWave's `path` method now reports the actual location of (clean) uploads on the filesystem.
* There is a rake task to simulate the running of virus scanning in development- `rake development:fake_virus_scan`

/cc @gma