fix(server): allow plus, at, and valid path characters in readValidDirectory