untaint'ing doesn't seem to work

Hi,

I'm really new to all this mod_ruby/CGI stuff so I'm guessing the
problems are solely due to my ignorance, but I can't find anything in
the docs or examples to help me out.

Here's what I'm using: mod_ruby 1.1.3, Apache 2.0.49, Ruby 1.8.1

I'm trying to learning about tainting/untainting so I wrote this short
script to "cat" a file.

         require 'cgi'
         
         query = CGI.new
         filename = query["filename"].dup
         filename.untaint
         File.open(filename) { |f|
           f.each_line { |l|
                   print l
           }
         }

This works fine if I throw a "RubySafeLevel 0" in the Apache config
file, but a safe level of 1 prints this error in the Apache log:
[Mon May 10 00:22:18 2004] [error] mod_ruby: error in ruby\n/var/www/localhost/htdocs/tmp/cat.rbx:7:in `initialize': Insecure operation - initialize (SecurityError)\n\tfrom /var/www/localhost/htdocs/tmp/cat.rbx:7:in `open'\n\tfrom /var/www/localhost/htdocs/tmp/cat.rbx:7\n\tfrom /usr/lib/ruby/1.8/apache/ruby-run.rb:53:in `load'\n\tfrom /usr/lib/ruby/1.8/apache/ruby-run.rb:53:in `handler'\n

I thought that untaint was supposed to stop the SecurityError from being
thrown.  When I added the line
        puts query["filename"].tainted?
it prints "false".

Any ideas?
Jeff