security fix: now path checking is stricker