security fix
path checking is stricker now