create upload_to directories as needed same as Django does (probably need some more security checks here but why are you allowing untrusted input for upload_to in any case?)