dont allow directory traversal. strip query arguments from requested file name.