This is to constraint this experimental feature more for now
and acts as an additional safety check.

We decided it's OK to rely on just the filename extension for now,
since we're already checking file contents during upload.