do not allow to upload files if no firewall is configured

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | yes
| BC breaks?    | only edge cases
| Deprecations? | no
| Tests pass?   | see travis
| Fixed tickets | -
| License       | MIT
| Doc PR        | TODO

The current code skips security checks if no symfony firewall is configured for the upload route. This fix limits this behaviour to when the user explicitly enables anonymous editing.
Also, we factor out the security check into a method to be more future proof.

/cc @rmsint