rework sanitized_source_directory using realpath