The safe path validation for file uploads with dropzone.js wasn't actually working following a recent refactor meant to reduce code duplication and cognitive complexity. The error response was happening in the wrong flask context and the file transfer was allowed when it should have been stopped.

Additionally, the file downloads validation, which used the same refactored method, ended up using the wrong type of flask response, leading to the app being aborted with a 403 instead of a flash warning displayed in the flask app.

Therefore, this patch removes the refactored method and brings the is_safe_path() check and response into the respective flask endpoints.

Two peripheral fixes pushed while working on this:

• tweaked the labels of the file download form, to make it clear the purpose of the target dir dropdown.
• clean up existing tmp file before uploading (otherwise the file size validation fails in the end.)