To do a server upload, the files would be FTP'd over to the server first, correct. There is also a single image upload option where the user can choose a single image and set its title/description.
If you are setting this up for a customer, you could always "disable" some functionality such as removing the Add to Site page if you didn't want them to see the code. Otherwise, you could apply SecurityAssist to assign more user roles, adjust the login logic, and lock down some of the pages accordingly.
-justin
