Not a problem - I've enabled XLS uploads. The security issue with XLS lies safely away from the server, at the user's end