As you are worried about user upload other file by mistake, I would suggest you to use accept=".csv"
in <input>
tag. It will show only csv files in browser when the user uploads the file. If you have found some better solution then please let me know as I am also trying to do same and in the same condition - 'trusted users but trying to avoid mistake'