don't allow client to pass in already valid paths