Confine MDTM request to files in CHROOT jail

This commit properly resolves MDTM request filenames to locations within
the CHROOT jail. Previously, requests were made relative to the
filesystem root (/), instead of the server root (/srv/files/from/here).

This allowed users to request MDTM on potentially sensitive files
(/root, /home), while simultaneously denying legitimate requests within
the shared directory.

Note: all filesystem calls *must* be joined with the path to the server
root (pathModule.join(self.root, filename)).

fix https://github.com/asylumfunk/nodeftpd/issues/28
ref https://github.com/sstur/nodeftpd/commit/57a9e5f9e0c9fd3e5fbdd7f847d5f0116dbd5a4a
ref https://github.com/sstur/nodeftpd/pull/5
ref https://github.com/sstur/nodeftpd/pull/9
Surround all blocks with curly braces

Style aside, this reduces bugs. In this case, the return statement was
indented such that it appeared to be part of the else block, whereas it
was actually executed regardless. This makes the code more robust.
Remove superfluous empty string

This string previously contained a <CRLF> sequence, when commands were
still writing directly to the socket.

ref https://github.com/sstur/nodeftpd/pull/2
ref 22c8d1754d84b4ed1242a43ef89945ee4d95eb4f
Remove superfluous newline
Return "this" instead of "undefined"

Methods without a return statement (including an empty statement)
implicitly return "undefined", limiting their usefullness. By
returning "this" from any object method without another return value, we
allow method calls to be chained together.
Remove superfluous response

In this case, if we can't find or access a file, the distinction is
irrelevant.  The generic error message would hint that the file actually
does exist, but is inaccessible for some other reason (insufficient
permissions, etc.). This behavior could have been leveraged by a
malicious user and should be removed.
Use a meaningful parameter name

Resolve file path more clearly
Remove "self" variable

Previously, "self" was being used to maintain a pointer to the "this"
value outside of the anonymous function. Instead, we use the native
Function.bind(...) method to bind the method to the caller's namespace.

Beyond removing a superfluous variable, this also prevents a user from
mistakenly referencing "this" inside the anonymous function instead of
"self".
Add jsdoc for MDTM command
Add test coverage for MDTM

This commit tests all branches of the MDTM command. It should accept
requests for existing files and reject requests for invalid files.
Remove superfluous newlines
Bump version to 0.2.7

Following the bug fixed at 322cf37916b1b2729914053b8a7d1f213f75549a,
it's time to push an update.
Merge pull request #24 from asylumfunk/i/28

Fix and test MDTM command