only sanitize_filename the actual filename