server: refactoring + deletion support

* Move per-request config loading and password checking to middleware
  (TODO: decide if config should be made global instead)
+ Added support for deleting uploads by ID and deleting the latest
  upload