Cakephp Upload plugin allows any file extension to be uploaded despite validation rules

Cakephp Upload plugin allows any file extension to be uploaded despite
validation rules

'model' => array(
'rule' => array('isValidExtension', array('xls')),
'message' => 'File does not have a stl extension'
),
Allows absolutely any file to be uploaded. I have this is as my first
validation rule. Other validation rules like notEmpty, and isUnique work
fine on the same form element.
Tried adding stl to the array found in the main behavior: 'extensions' =>
array('xls') - also did not work.
Any idea on what I'm doing wrong here?
Also: This appears to happen regardless of the file extension I pick. No
matter what, it doesn't call the file invalid. The same issue appears to
happen with Mime types as well.
The plugin URL is: https://github.com/josegonzalez/upload