BUG: fix brittle path manipulations

Use os.path.join instead of concatenating strings, use os.path.relpath
rather than relying on brittle assumptions.
BUG: fix zip file upload location

Django refuses to upload files outside MEDIA_ROOT, so we have to make
sure we use paths relative to it.
ENH: store all non-static data files under data/

This includes uploads, sqlite databases, compilation caches, etc.