path and basename must be CGI.escape before rendering