correctly escape backslashes in request path globs

make sure that unreadable files are also not leaked

CVE-2014-7829
bumping version for relesase
Merge branch '4-0-sec' into 4-0-stable

* 4-0-sec:
  bumping version for relesase
  correctly escape backslashes in request path globs