SECURITY: API: Avoid some silliness with browser-guessed filenames