double check for dir traversal in api browser