setting the allowed mimetypes for file upload as a security measure