5 and 4 done

They work, but some questions are unanswered about finer details.

#check protocol : split sends? and 1/0 for Dir/File

#forum questions:
#location of hijack root
#protect ourselvs from dir traversal?
#if a non existant jpg is requested, do we return real jpg?