working upload with file-type checking