mimetype checking on uploads as well