dropped the "const" from the return value of safe_fname() because