don't allow names starting with / resolves #3