Do not allow HTML media files - risk of XSS attacks