extract_files(): security fix.

The names of the extracted files where not checked for the special
directory "..". This would allow a malicious user to successfully
perform a path traversal attack.
extract_files(): add support for directories.

The filenames in a request are now treated as paths. Thus, directories
may be created and the files may be placed inside them accordingly.
Directories in libraries are not yet supported, but this is the first
step.

Also fixed a small grammatical error in the documentation.