use a Tempfile rather than defining hacky methods on StringIO for profile photo upload