Check for directory traversal after unescaping

The `forbidden_request?` check could be trivially bypassed
by percent encoding .. as %2e%2e.

After auditing Sprockets and Hike and fuzzing a simple
server, I don't believe this is exploitable. However,
better safe than sorry/defense in depth/etc.
Sprockets 2.2.1
protected methods return false unless a second argument is passed to
respond_to?.  This only impacts trunk ruby, but will be included in Ruby
2.0.

  https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/34580
Sprockets 2.2.2

Special :heart: release
CMON ENCODING FUCK YOU