Abstract the allowed file types out of API

closes #1891
- Moves contentType and extension check to config
Merge pull request #4188 from halfdan/1891-move

Abstract the allowed file types out of API