Be paranoid about sandbox escaping

E.g. on Windows \ is also a path separator, so checking just for /.. is
not enough.