Make it more secure

Stops files being downloaded outside of the dir, along with .php being
unable to be downloaded.