use SCRIPT_NAME to generate /-adding redirects, not SCRIPT_FILENAME

The latter leaks filesystem information into the URL, and is certainly
not what you want.