crude hack to prevent /.. in urls