I think the reasonable approach is to look at just the uri:

sub handler {
  my $r    = shift;
  my $log  = $r->log;

  # The real content type is not available 
  # until the ContentHandler
  my ($content_type) = $r->uri() =~ /\.(\w+)$/;
  my %ignore = map {$_ => 1} qw(gif jpg jpeg png css);
  if ($ignore{lc($content_type)}) {
    $log->debug( "Allowing access to ($content_type)." );
    return DECLINED;
  }
  
  ...
[download]