sanitize file upload options