add checking of actual mime type (rather than reported)
Merge remote-tracking branch 'lf/feature/fileupload'