add mime type verification on client side