validate that the paths are actually inside the media directory
otherwise raise a 403