every user has it's own directory in private
added file extension check