diff --git a/Main.hs b/Main.hs
--- a/Main.hs
+++ b/Main.hs
@@ -1,8 +1,9 @@
 module Main where
 import Control.Applicative ( liftA2 ) -- base
+import Control.Exception ( catch ) -- base
 import Control.Monad ( when ) -- base
 import Control.Monad.IO.Class ( liftIO ) -- transformers
-import Control.Monad.Trans.Resource ( withInternalState, runResourceT ) -- resourcet
+import Control.Monad.Trans.Resource ( withInternalState, runResourceT, ResourceCleanupException ) -- resourcet
 import qualified Data.ByteString as BS -- bytestring
 import qualified Data.ByteString.Char8 as CBS -- bytestring
 import qualified Data.ByteString.Lazy as LBS -- bytestring
@@ -14,7 +15,7 @@
 import Data.Monoid ( (<>) ) -- base
 import Data.String ( fromString ) -- base
 import System.Console.GetOpt ( getOpt, usageInfo, OptDescr(..), ArgDescr(..), ArgOrder(..) ) -- base
-import System.Directory ( getDirectoryContents, doesDirectoryExist, getModificationTime, copyFile, doesFileExist ) -- directory
+import System.Directory ( getDirectoryContents, doesDirectoryExist, getModificationTime, renameFile, doesFileExist ) -- directory
 import System.Environment ( getArgs ) -- base
 import System.FilePath ( makeRelative, (</>), takeDirectory, takeFileName ) -- filepath
 import System.IO ( putStrLn, hPutStrLn, hPutStr, stderr, hClose, openBinaryTempFileWithDefaultPermissions ) -- base
@@ -30,7 +31,7 @@
 import Network.Wai.Middleware.Local ( local ) -- wai-extra
 import Network.Wai.Middleware.RequestLogger ( logStdout ) -- wai-extra
 import Network.Wai.Middleware.Static ( staticPolicy, addBase, isNotAbsolute, noDots, Policy, tryPolicy ) -- wai-middleware-static
-import Network.Wai.Parse ( tempFileBackEnd, parseRequestBody, fileName, fileContent ) -- wai-extra
+import Network.Wai.Parse ( tempFileBackEndOpts, parseRequestBody, fileName, fileContent ) -- wai-extra
 
 import Crypto.Random ( getSystemDRG, randomBytesGenerate, SystemDRG ) -- cryptonite
 
@@ -63,7 +64,7 @@
 -- Not future things: CGI etc of any sort, "extensibility"
 --
 vERSION :: String
-vERSION = "0.4.1.0"
+vERSION = "0.4.2.0"
 
 -- STUN code
 
@@ -165,24 +166,28 @@
 update opts policy copyFileFn app req k = do
     if requestMethod req == methodPost then (do
         runResourceT $ do
-            (_, fs) <- withInternalState (\s -> parseRequestBody (tempFileBackEnd s) req)
-            -- If UploadOnly then ignore the path part of the URL, i.e. only write the file to the base directory.
             let prefix = if optUploadOnly opts then "" else CBS.unpack (BS.tail (rawPathInfo req))
-            liftIO $ when (optVerbose opts) $ putStrLn (CBS.unpack (BS.tail (rawPathInfo req)))
-            liftIO $ forM_ fs $ \(_, f) ->
-                case tryPolicy policy (prefix </> CBS.unpack (fileName f)) of
-                    Nothing -> return ()
-                    Just tgt -> do
-                        let src = fileContent f
-                        when (optVerbose opts) $ putStrLn ("Saving " ++ src ++ " to " ++ tgt)
-                        copyFileFn src tgt
+            case tryPolicy policy prefix of
+                Nothing -> liftIO $ ioError $ userError "Forbidden" -- TODO: k (responseLBS status403 [] (LBS.fromChunks [CBS.pack "Forbidden"]))
+                Just tgtDir -> do
+                    liftIO $ when (optVerbose opts) $ putStrLn (CBS.unpack (BS.tail (rawPathInfo req)))
+                    (_, fs) <- withInternalState (\s -> parseRequestBody (tempFileBackEndOpts (return tgtDir) ".sws.tmp" s) req)
+                    -- If UploadOnly then ignore the path part of the URL, i.e. only write the file to the base directory.
+                    liftIO $ forM_ fs $ \(_, f) ->
+                        case tryPolicy policy (prefix </> CBS.unpack (fileName f)) of
+                            Nothing -> return ()
+                            Just tgt -> do
+                                let src = fileContent f
+                                when (optVerbose opts) $ putStrLn ("Saving " ++ src ++ " to " ++ tgt)
+                                copyFileFn src tgt
         app req k) -- We execute the next Application regardless so that we return a listing after the POST completes.
+          `catch` (\e -> const (app req k) (e :: ResourceCleanupException)) -- HACK: tempFileBackEndOpts attempts to remove the temp file but we've already removed it.
           `catchIOError` \e -> if isUserError e then k (responseLBS status409 [] (LBS.fromChunks [CBS.pack $ ioeGetErrorString e])) else ioError e
       else
         app req k
 
 overwriteFile :: String -> String -> IO ()
-overwriteFile = copyFile
+overwriteFile = renameFile -- copyFile
 
 errorOnOverwriteFile :: String -> String -> IO ()
 errorOnOverwriteFile src tgt = do -- TODO: This has a race condition.
@@ -190,13 +195,13 @@
     if exists then do
         ioError $ userError "Attempting to overwrite an existing file."
       else do
-        copyFile src tgt
+        renameFile src tgt
 
 renameOnOverwriteFile :: String -> String -> IO ()
 renameOnOverwriteFile src tgt = do
     (tgt, h) <- openBinaryTempFileWithDefaultPermissions (takeDirectory tgt) (takeFileName tgt)
     hClose h
-    copyFile src tgt
+    renameFile src tgt
 
 -- Directory listing
 
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@
 making a password or a certificate are inconvenient, so `sws` can generate these. *Currently, support for generating
 a certificate is removed.*
 
-### Use-case 1: xkcd scenario
+### Use-case 1: Large file transfer
     
 You want to send a large file to someone.  You browse to the directory containing it, type "`sws`", and give them
 your public IP.  They browse to it and download.  Maybe they are the ones sending the file, but aren't "technical".
diff --git a/sws.cabal b/sws.cabal
--- a/sws.cabal
+++ b/sws.cabal
@@ -10,17 +10,15 @@
 -- PVP summary:      +-+------- breaking API changes
 --                   | | +----- non-breaking API additions
 --                   | | | +--- code changes with no API change
-version:             0.4.1.0
+version:             0.4.2.0
 
 -- A short (one-line) description of the package.
-synopsis:            A simple web server for serving directories, similar to weborf.
+synopsis:            A simple web server for serving directories.
 
 -- A longer description of the package.
 description:         
-    The main drivers for this application were Windows (and Linux) support and
-    security, and to a lesser extent performance.  Security is improved over
-    weborf by using Haskell, supporting TLS, and explicitly NOT supporting CGIs
-    of any kind.
+    The main drivers for this application were Windows (and Linux) support,
+    security, and to a lesser extent performance.
 
 -- The license under which the package is released.
 license:             BSD3
@@ -65,37 +63,37 @@
   -- other-extensions:    
   
   -- Other library packages from which modules are imported.
-  -- build-depends:       
-    -- base >=4.6 && <4.10,
-    -- bytestring(==0.10.*), 
-    -- cryptonite(==0.24.*),
-    -- directory(==1.3.*), 
-    -- filepath >=1.3 && <1.5, 
-    -- http-types(==0.9.*), 
-    -- hourglass(==0.2.*),
-    -- network(==2.6.*),
-    -- resourcet(==1.1.*),
-    -- transformers(==0.5.*),
-    -- warp >=3.0 && <3.3,
-    -- warp-tls >=3.0.1.2 && <3.3, 
-    -- wai >=3.0 && <3.3,
-    -- wai-middleware-static >=0.6 && <0.9, 
-    -- wai-extra >=3.0.3 && <3.1
+  --build-depends:       
+  --  base                  >= 4.9.1 && < 4.11,
+  --  bytestring            >= 0.10.8 && < 0.11,
+  --  cryptonite            >= 0.24 && < 0.26,
+  --  directory             >= 1.3.0 && < 1.4,
+  --  filepath              >= 1.4.1 && < 1.5,
+  --  hourglass             >= 0.2.10 && < 0.3,
+  --  http-types            >= 0.9.1 && < 0.13,
+  --  network               >= 2.6.3 && < 2.7,
+  --  resourcet             >= 1.1.9 && < 1.3,
+  --  transformers          >= 0.5.2 && < 0.6,
+  --  wai                   >= 3.2.1 && < 3.3,
+  --  wai-extra             >= 3.0.20 && < 3.1,
+  --  wai-middleware-static >= 0.8.1 && < 0.9,
+  --  warp                  >= 3.2.13 && < 3.3,
+  --  warp-tls              >= 3.2.4 && < 3.3
   build-depends:       
-    base                  >= 4.9.1 && < 4.11,
+    base                  >= 4.11.1 && < 4.12,
     bytestring            >= 0.10.8 && < 0.11,
-    cryptonite            >= 0.24 && < 0.25,
-    directory             >= 1.3.0 && < 1.4,
-    filepath              >= 1.4.1 && < 1.5,
-    hourglass             >= 0.2.10 && < 0.3,
-    http-types            >= 0.9.1 && < 0.10,
-    network               >= 2.6.3 && < 2.7,
-    resourcet             >= 1.1.9 && < 1.2,
-    transformers          >= 0.5.2 && < 0.6,
+    cryptonite            >= 0.25 && < 0.26,
+    directory             >= 1.3.1 && < 1.4,
+    filepath              >= 1.4.2 && < 1.5,
+    hourglass             >= 0.2.11 && < 0.3,
+    http-types            >= 0.12.1 && < 0.13,
+    network               >= 2.7.0 && < 2.8,
+    resourcet             >= 1.2.1 && < 1.3,
+    transformers          >= 0.5.5 && < 0.6,
     wai                   >= 3.2.1 && < 3.3,
-    wai-extra             >= 3.0.20 && < 3.1,
-    wai-middleware-static >= 0.8.1 && < 0.9,
-    warp                  >= 3.2.13 && < 3.3,
+    wai-extra             >= 3.0.22 && < 3.1,
+    wai-middleware-static >= 0.8.2 && < 0.9,
+    warp                  >= 3.2.22 && < 3.3,
     warp-tls              >= 3.2.4 && < 3.3
   
   -- Directories containing source files.