Do we need to sanitize `path`?  For example, to strip out `..`?