Strictly sanitize filename since Content-Disposition is really fussy