Add support for file type validations

closes #5
closes #44
Document that “Origin” header needs to be set in CORS config, closes #5