This doesn't prevent local file inclusion or directory traversal. We should fail to handle any requests that include `..` or the `%2c` in them.