Passed db to fileupload middleware to be ready for security check

See /*Security*/ block in middleware/fileupload.js.
To be implemented.
Also, optionally, we need a 're-fetch' upon showing the record form
that contains file fields, so we can put a record _id in session then
later use this to match the one used in POST/DELETE /uploads to ensure
that users won't get a chance to modify files that were not intended to
modify in other records (wierd...tho)