I ended up adding path_info_regex parameter to the path handler definition that untaints path_info for future use, while resulting in 404 if it doesn't match. Current behavior is deprecated and will be phased out in future versions (in fact, the regex will just get a default value equal to ^$). What I originally came up with was clearly overengineered. Thanks again for the discussion!