http_static: sanitize path before file read