CVE-2014-0130 protection

This raises an exception if we're trying to render an action where the name includes `/`. While we initially thought 2.3 was not vulnerable, this has been shown to not be the case.

cc @github/dotcom-security