When not using the Django sites framework, you get a RuntimeError
because it is not installed, even if you set DJANGO_MESSAGES_NOTIFY to
False.

This can be avoided by importing the site model only when necessary.

Now django-messages support attachments when composing or replying.
Attachments are stored by default in an "attachments" folder relative to
the ``MEDIA_ROOT``, but this can be changed with the new
``DJANGO_MESSAGES_UPLOAD_TO`` setting.

The default django filesystem storage being not very secure, and thus
not appropriate for private messages attachments, now one can pass a
custom storage backend.

Also added a note on security in the relevant documentation.