Better allowedExtensions check

the original one (get file extension, check if it's listed on allowedExtensions) does not work with multiple suffixes (like file.tar.gz), because its hard to tell what is "extension" there.

This one is better: if filename ends with something that is listed on allowedExtensions, it's ok.