don't allow the browser to open uploaded html/css/js
more XSS blockage of uploaded files