disallow commands with path separators