Update docs for file().

Mention that relative paths will be prepended with APP.

Refs #3370
Reject file paths containing `..`.

Paths containing `..` are generally up to no good. Throw an exception,
as developers can use realpath() if they really need to get relative
paths.

Fixes #3370