server/upload.py: document and use a more secure default location for LOCKFILE