>>16 and >>17

yep, i'm running mode_image and i've figured out that i'm a complete idiot because the password was being stored in my cookie and so appeared like the "default" password.

Re filetypes: i've just bitten the bullet and turned on Allow Unknown for now

thanks for the help!