Fix race and leak

Sorry for submitting two commits in this pull request, but the second builds on the first.
See the man pages for dupload - quoting from the dupload man page:
>     -c --configfile
>         Read the file ./dupload.conf (if it exists). Warning: this is a security risk
>         if you are in a directory where other people can write.  That's why it is not
>         the default (unlike the previous versions).

I can't check Debian, but it's definitely there on Ubuntu 12.04 and 14.04, and the changelog for dupload seems to indicate this option has been around for many years.