I'm super excited someone took this bug on... I had almost forgotten about it.  Did you test with global datastore?  Like if someone did setg URIPATH /blah
I didn't look into it just now, but I wanted to check that "if exploit.datastore['URIPATH']" catches that, I think the datastore call will fall thru from module to global to default so it's ok.  I'll test when I get a chance.

On a side note, I guess you could just call remove_resource regardless since you are rescuing NoMethodError anyways and just skip the if entirely?