this time *really* fix the /../ check ...