Allow passing uploaded files as File or Inputstream objects to form methods.

Passing files as strings (i.e. paths to the temporary files) allows an
attacker to submit a filename instead of an actual file. The servlet has
no way to find out that this happened, and can therefore be tricked into
reading content from arbitrary files on the server.