Let's add another check (maybe middleware exists for this already) to filter out contentTypes that aren't image/* (image/png, image/gif, ...).  We don't want to store arbitrary files for people.