264 restrict default file editor path to uploads

By default prevent browsing whole Croogo App Dir and restrict to `uploads` folder within app webroot.
I'd prefer to avoid private methods.