Fix clean_filename to strip more unsafe chars