taint: allow appenfile create_file option to specify a de-tainting safe path