cleaner handling of malicious attempts to walk up the filesystem