I'd suggest to filter out any relative path movements and return errors for that.
a MalformedPathException from the storage interface, which the http layer can translate into a 400 bad request.
What do you think? I can't think of any situation where we want to allow such movements.