disable path traversal protection to allow image urls in path