Add a list of authorized extensions for file uploads

I'm working on allowing arbitrary file uploads.

This is the *first* step of many. I'm splitting this feature into several PRs so that they are easier to digest/check/merge.

This one adds the `authorized_extensions` setting which lists the allowed extensions for uploads (defaults to: `.jpg|.jpeg|.png|.gif`).
It's currently only used in the client side. 

![screen shot 2013-07-01 at 2 32 45 am](https://f.cloud.github.com/assets/362783/728095/c425b654-e1e5-11e2-8cfa-e67f5971d847.png)

**Note:** The server side stays unchanged and will refuse any non-image file for now.