Fixes 2 security bugs

FIX: check_path would not return 1 if strict=1 in lshell.conf so forbidden commands would still execute

FIX: tab-completion would still complete forbidden paths