Security

• disallow render paths outside destination directory
• cast Jinja context path variables to pathlib.PurePath