replace flawed commonprefix check with relpath

Adds a test (same PoC described in the audit)
tighten scope in store.verify
Merge pull request #237 from garrettr/feature/194/fix-imprecise-store-verify

Fixes #194