reject cross-location paths in pylock files fetched from a URL