Security fix: Reject invalid paths (containing < > &); Encoding: Allow UTF-8 requests