Apparently it's possible to receive URLs with e.g. slashes in the query
string. I was under the impression those were reserved in the query string,
but e.g. Firefox will happily accept them as well.

It would be unfortunate if a long file name would cause us to open a file
based on mostly uninitialized data and write the contents of some random
webpage into it.

Instead of an entire device.