correct some bugs

- add upload function working with a path on the filesystem.
- implement app:// protocol
- add security level (cannot access node.js from apps, nor the system
calls.)