Remove execute bit from categorizon.py, making sure we run through run.sh
One more check in is_unsafe_filename()
Filename and contents API (client determines file mimetype via HTTP HEAD request for file contents, bottle.py has awesome magic to make this work cleanly)