security fix

changed to use /tmp/ for writing temp files
so that they wouldn't be accessible from the
client browser.