save user pics in WEB-INF/profilepics (as the previous commit, this is
only tested to work in the default config of tomcat7)