absolutize root path since it might be outside server root and will be considered malicious by express if it contains ..