why not return something from `sanitize_filename` instead of a new function?