safe version of Unix's mv command