security: need to specify protocol format and not treat as path verbatim

[gulachek]

Implementations can't trust a connecting client that the protocol is in the expected format. We need to validate the format and treat it as a file name (instead of a path by looking at directory children). Impact is obvious

[gulachek]

fixed