Abstract the allowed file types out of API

closes #1891
- Moves contentType and extension check to config