HTTPServerSimple.pl: prevent directory traversal