Use https for bundler, allow optional Gemfile.local
Extract directory traversal detection to an independent method