tumblr_backup: Do not allow slashes in blog names

Accidental directory separators allow some of the code to function while
other code does the wrong thing. Don't allow them, and also disallow the
special "." and ".." directories.

tumblr_backup.py

@@ -259,6 +259,8 @@ def get_api_url(account):
     """construct the tumblr API URL"""
     global blog_name
     blog_name = account
+    if any(c in account for c in '/\\') or account in ('.', '..'):
+        raise ValueError('Invalid blog name: {!r}'.format(account))
     if '.' not in account:
         blog_name += '.tumblr.com'
     return 'https://api.tumblr.com/v2/blog/%s/%s' % (