Upnp fix root access

There's a security hole in UPnPServer whereby arbitrary paths can be requested (such as '/', '/home/ etc..). 

this is a tidy up of #2157. There was talk of re-purposing the handling in the webserver which dissallows access outwith media directories but I'm on holiday right now and think this is a reasonable fix in the interim which could then be backported to any possible 12.3 releases.

thoughts?