escape wildcards
use rsync, not mv