cleaner way of building $allowed_extensions array

also modified javascript regexp pattern output; removed leading slash, trailing slash, and case-insensitivity flag (because the javascript that makes use of this string breaks if you do it this way)