Some things now return also 403.

/login throws a 403 when failing to log in, and /upload when the visitor is not
logged in.
Add a simple json config to upload.py

config can be located at $HOME/.fileuploaded rc or ./fileuploadrc.