do not allow / or .. in files requested by web clients