added mime-type security to file uploads