Allowed file extensions setting not enforced for files with an unknown mimetype

File upload validation now checks extensions directly instead of relying on mimetype table lookups, preventing unintended accepts when OS/Python versions don't recognize extensions.