Add client-side file type validation, fix server-side validtion