Don't allow uri-encoded dots either

Use a URIDecoded copy of the path when checking for dot.