move upload dir into app dir
use DB environment variable if present
add xml to allowed content types