untaint plugin filename, will be tainted if specified at the command line