[security] view was giving web access to every fs file accessible by the web server process. Fix this security hole by storing file in session data, not direct form parameters

rql('SET X name "BoundaryConstraint" '
    'WHERE X is CWConstraintType, X name "BoundConstraint"')