forbid IO::Path in the restricted setting