Fix major security bug (directory traversal)

This middleware permits directory traversal. If you write your main app in coffeescript (app.coffee) it is possible to retrieve the main app file (and any other files on the filesystem written in coffeescript) using this module.

This fix makes sure all files requested are relative to the src folder.