Re-use http.Dir for file handling

I was mostly curious why you didn't use http.Dir. It handles some basic exploit checks etc.