You're half right. Not instead of (anyway we should reject files, even with text/plain mime type), but along with.