allow path traversal in hyper-links