fetch: require output directory to save to, only allow bare filenames