Check file magic to avoid broken images

- gif/png/jpeg are let through
- .ico is redirected to google's converter
- everything else is invalid