The old code checked for `'..' in self.path`, primarily because of paranoia (e.g. what if you're on Windows and some hacker is trying HTTP requests to `/README.txt\..\..\..\..\..\someexploit-or-something` -- I don't do Windows, I don't know what's the equivalent of `../../../etc/passwd` in that land).  The new code weakens the check to `'/..'`.  Why?