Added Security Checks and JSON

Check to make sure there are no '..' in the path when creating or
deleting files/folders. Since we always append the path to the root,
there is never a case where they would be needed.

Ajax requests now return a JSON string to indicate success/failure