Sanitize version param when using cache

We don't allow malformed strings to be passed as version when sending
files from cache. Other params were already sanitized: no released
versions are affected.

Also additional check for the final path is there. It shouldn't be needed
for now, but in case somebody adds new params in feature and forgets
about sanitation, it's better safe than sorry.