Uploaded files must be accessed by their tmp_name.

Only after moving them to a sane location can the real name be used.