use SCRIPT_NAME to generate /-adding redirects, not SCRIPT_FILENAME

The latter leaks filesystem information into the URL, and is certainly
not what you want.
Merge pull request #1 from djmitche/master

use SCRIPT_NAME to generate /-adding redirects, not SCRIPT_FILENAME