add image authorization on upload_avatar

Checks that the file uploaded as an avatar has an autorized image extension. It was possible to upload any type of file.