Passing the file as kwarg instead of as get parameter.

Security checks were then no longer necessary, since there can't be a real path
traversal any longer. adding "../" would now resoult in downtraversing the url
only.