Only the second and subsequent path components were being checked, which
I guess is theoretically security-relevant.
There's no apparent point to reconstructing the path after splitting it
by adding /s back in, either.
"Module path must be a string" is not a useful error message when the
reason the module path isn't a string is because the string it was got
replaced with an invalid with an error message for some other reason.
Also fixes a few memory leaks on early exits.
Muh Muhten