api: avoid confusion between fs path and url path joins