Implement proper path matching

* Allow paths with multiple segments after base, eg /fay/foo/bar.js
* Prevent directory traversal