[CVE-2014-7829] correctly escape backslashes in request path globs

make sure that unreadable files are also not leaked

CVE-2014-7829