limited HTML file input to images