Only try to autoload classes with valid names

Summary: spl_autoload_register(function($class) { require "/my/classpath/$class.php"; });

means

    $class = $_GET['view_module'];
    new $class();

is now an RCE using /?view=../../../../../../../var/log/httpd/access_log%00

It should only allow characters that are valid in class names.

Reviewed By: @markw65

Differential Revision: D1556938

Pulled By: @ptarjan