[security] view was giving web access to every fs file accessible by the web server process. Fix this security hole by storing file in session data, not direct form parameters

if 'same_as' in schema:
    sync_schema_props_perms('same_as', syncperms=False)
sync_schema_props_perms('Bookmark', syncperms=False)