allow only png/gif/jpeg in file input dialog

Maybe in addition to server-side validations we should also have client-side validations in form of an `accept:` option on the file input dialog?

It's not hard to override this view, but at least for me it makes sense to have it built-in.