no anonymous upload on read-only folders

fixes #3941 

@butonic @MTGap @icewind1991 @schiesbn @karlitschek THX

EE relevant - backport necessary