Photos

Uploads are checked by their content (a PNG must start like one), saved in data/photos/, and served by file.send.