strip '../' parts from filenames to prevent directory traversal attacks