for security, disallow .. in the file name as returned by TSQLRestServerURIContext.ResourceFileName property