multiple fixes

security fix: deny unknown file endings
(it was possible to upload foo.php files that had the
mime type of text/plain)

actually set current_user.custom_errors when file upload fails