taint: allow appendfile create_file option to specify a de-tainting safe path