sanitize filepaths provided by checkUrl