Made the allowed filetypes configurable in config.yml. Added an extra check for uploads in the backend as well.