fixes #1: account for ".." in relative urls