updated safe_open to properly handle BOMs