security: forbid `\\` in local dev server requests