Strip out non-alphanumeric filename characters

We already did this for URL uploads, I'm just adding it to file uploads