protect filenames, check for curl

protect filenames, check for curl