check normalize() restricts access to root parent dirs

add two tests that check the path used for combo urls like:

- not allowed: /combo?/public/../../README.md
- is allowed: /combo?/public/../fixtures/robot.txt

note: I don't think allowing "../" in a combo url should be supported, if only because of the increased length.