I'm wondering if this regex is too strict.  Once it's in "public/", and doesn't include nasty stuff like "..", why should we limit the extensions?