check normalize() restricts access to root parent dirs

add 3 tests that check the path used for combo urls like:

1. undefined: /combo?/public/../../README.md
2. resolved relative to docroot: /combo?/public/../fixtures/robot.txt
3. resolved relative to docroot: /combo?/public//\/etc/passwd
minor test name and readability edits
real getAssetFromFSfn() should cb(err) on undefined paths

Illegal combo url requests resolve to undefined paths.
Falsey path values result in cb(err).
fix whsp
Merge pull request #2 from isao/tests

check normalize() restricts access to root parent dirs