Prefix arbitrary url with './'; still exploitable

Relative path exploits still applicable
Use query stringless url pathname for remote
Call end on request