don't allow slashes in directory components