Add a list of authorized extensions for file uploads

I'm working on allowing arbitrary file uploads.

This is the *first* step of many. I'm cutting this feature into several PRs so that they are easier to digest/check/merge.

This adds the `authorized_extensions` setting which lists the allowed extensions for uploads.
It's currently only used in the client side. 

The server side stays unchanged and will refuse any non-image file for now.