initial attempt to handle shopify whitelist.

this should allow only paths in our base/cwd and allowed by shopify to be uploaded.