Fixed checking for illegal requires

The first commit fixes the check for requiring stuff outside the module root.

`path.normalize` will return a path without `..` or `.` in it, so if the beginning starts with `..`, then we know they're trying to access something outside of the module root (or they're being stupid and doing unnecessary work, like '../dir/file' where we're already in dir, but that's a bug anyway).

The second commit just cleans some stuff up. I was going to make some changes, but I couldn't figure out where to do it, so I committed what I had. The only important part is adding `Array.prototype.forEachAsync` to package.json dependencies because the tests use it.