Do not expose hidden users' names in file uploads.

This change SHA1 sums the username in the filename / path.

Issue #315