server: avoid invalid cross-device link error

postFile was downloading to a temp file to generate the hash before
moving the file to its final location, but renaming from /tmp apparently
breaks on Gentoo, so now it downloads to the same place.