Improved path clearing

We now remove 0-byte characters and ../.
We should only accept "absolute" URLs to prevent security issues.