improve path treatment and security; add global.R support