allow content authors to upload images for categories

`os.path.join` and we need to make sure we're not accepting people's filenames. Happy to store that as metadata but not what it ends up as on disk.