Allow passing uploaded files as File or Inputstream objects to form methods

Passing files as strings (i.e. paths to the temporary files) allows an
attacker to submit a filename instead of an actual file. The servlet has
no way to find out that this happened, and can therefore be tricked into
reading content from arbitrary files on the server.

Ideally, the old String passing for uploaded files should be removed entirely.