update to authentication filters on experience points controller to allow parents to view xp show
Merge remote-tracking branch 'upstream/master'
only allow images and pdf to resources and fix content type error in file uploaders