Return early if no mime type
reorder the checks

put the check for exploit_file_types first, since it is the one
that populates monitored_hosts
cache f$conns[cid] and other tweaks

Use join_string_set for building the list of files
Use a regex for the Java user agent check