fix CVE-2013-0248:
  https://issues.apache.org/jira/browse/FILEUPLOAD-212
  http://seclists.org/fulldisclosure/2013/Mar/76
 and update Commons IO 2.4 (Java1.6+)