Use common to_io so users can access the underlying IO object

No disadvantages to delegating to tempfile. Whitelisting
considered harmful when people expect an HttpUpload to quack like an IO
object eg to_io in my case was expected to be defined.