Prevent against directory traversal attacks.

I know this package shouldn't be used in production, however it bothers me that simply asking for `http://localhost:5000/..` lists the parent directory without returning a 403. And checking for this kind of stuff can also be useful in development, just to make sure that all will work well when deploying on a server that checks for directory traversal attacks.

Result:
````
$  curl http://localhost:5000/..
Unauthorized.%
```
----

Check if the full URL we will serve (be it a directory or a file) is contained in the root. Otherwise we return 403, as it means the user is trying to access some directory that should not be accessible.

http://en.wikipedia.org/wiki/Directory_traversal_attack