secure move_uploaded_files params

Deploying to a PHP enabled server allowed attackers to upload arbitrary files to the server when the example files were included (like package managers like Bower do).