Use normalizePath in Brewery

This prevents users from request urls with '..' in them and accessing files in arbitrary directories.