disable rack-protection's :path_traversal, escape title with CGI.escape