fix #65: handle empty MEDIA_ROOT settings and add settings checks

[olivierdalang]

This prevents trying to serve files from MEDIA_ROOT if it is not set (fixing #65) and adds some checks using Django's check framework to prevent the user moving forward with settings that do not make sense.

Please review carefuly, as I'm not 100% I correctly understood the workflows involving local files.

Notes:

• initially I though we could reuse django.conf.urls.static, but there's no validation there either (it checks only for the URL prefix, not that MEDIA_ROOT is set)
• I upstreamed discussion to Django here https://forum.djangoproject.com/t/media-root-defaulting-to-empty-string-isnt-that-dangerous/36567