[ORB-336] disallow non-pdf/image filetypes