fix path normalization + avoid invalid /.. path

- absolute path to go upper than root should not be allowed
- ../.. normalization should keep it as-is
reformat