Limit image file types and avoid encoding sensitive data in file path

[PGijsbers]

• For profile pictures, allow only jpeg since that is the only format that actually works when retrieving the image.
• Make sure that the path under which it is stored on the server does not contain sensitive data. In this case, the user name might have contained the e-mail of the user.

Warning

I have not been able to test these changes.