Make sure clients cannot overwrite address book

Tighten the regex for valid resources and change the name of the default
address book file so that it is not covered by that regex. This will
prohibit clients from accidentally or maliciously PUTing to that file.

storage/filesystem.go

@@ -24,7 +24,7 @@ type filesystemBackend struct {
 
 var (
 	nilBackend         carddav.Backend = (*filesystemBackend)(nil)
-	validFilenameRegex                 = regexp.MustCompile(`^/[A-Za-z0-9_-]+(.[a-zA-Z]+)?$`)
+	validFilenameRegex                 = regexp.MustCompile(`^/[A-Za-z0-9][A-Za-z0-9_-]+(.[a-zA-Z]+)?$`)
 )
 
 func NewFilesystem(path string) (carddav.Backend, error) {
@@ -153,7 +153,7 @@ func (b *filesystemBackend) AddressBook(ctx context.Context) (*carddav.AddressBo
 	if err != nil {
 		return nil, err
 	}
-	path = filepath.Join(path, "default.json")
+	path = filepath.Join(path, "_default_ab.json")
 
 	data, err := ioutil.ReadFile(path)
 	if os.IsNotExist(err) {