Patch possible read vulnerabilities

/cc @gregose @mastahyeti @benbalter 

Looks like the layouts vuln wasn't present in Jekyll 2.0 :smile: