[security] view was giving web access to every fs file accessible by the web server process. Fix this security hole by storing file in session data, not direct form parameters

addressbook
basket
blog
book
calendar
comment
company
email
file
folder
i18ncontent
keyword
link
mailinglist
person
tag
timeseries
vcsfile