wait what does it even mean to require a resource that contains `..` if the urls are relative to the card location?  why can't we just say that resources that don't begin with `/` are just appended to the sandbox's url?