Canonicalize relies on the file existing to resolve the potential
traversal, which won't work for file upload in case the file name has a
traversal inside it.
Previously files added while the server is running would not have
thumbnails until after the server was restarted. Now we watch the
BASE_PATH for added/renamed files in order to re-gen the thumbnail.