restricting image uploads to png and jpegs