Make sure we don't allow path escaping