This needs escaping or something before display, as a malicious user could send a nasty filename. We probably want to use something in utils.js (or base it on) for this.