Secured the multiuploader (somewhat, still needs csrf)
Misilaneus bullshit
And galleryfy works all the time, not just when allow_html=True