guard against requesting arbitrary PDF files from hosted viewer