Do not allow walking the file system (fixes #3)

This avoids any possible attacks like those outlined in issue #3 where
the user sends a URL with slashes in it to load files from various
places on the server.