refactored into allowed
base image added in server, and disallowed images not even shown, which should make things more stabe.