md5 checksum comparison for remote vs local

+ Fixes weak file comparison by comparing md5 checksums as a fallback
(to avoid expensive ops) after file size and lastModTime comparisons.
Yes, you don't need a third party lib though. Especially if the third party is behaving weirdly, such as what it's doing on https://github.com/gosexy/checksum/blob/master/checksum.go#L80 :scream:

A similar snippet would be:

~~~ go
f, err := os.Open(f.BlobAt)
if err != nil {
  return ""
}
h := md5.New()
if err := io.Copy(h, f); err != nil {
  return ""
}
return h.Sum(nil)
~~~