Limit search to only return matches within given URI roots

Fixes #337