I was assuming user's journal admin authentication meant form didn't need much in the way of validation, but I'm fine with adding it; I'll postpone looking at other image upload code.  The settings form makes it clear that only two suffixes are allowed, and shows a link to the uploaded file so I'm willing to leave it at that for now, if you are, Alex...