Fix path traversal/injection security bug. Thanks to Steven Frank at panic.com for...