fix gaping security hole in fixture upload
Merge pull request #505 from dimagi/upload-fixtures-safety

fix gaping security hole in fixture upload