use hardcoded mimetype, don't rely on uploaded one