Verify PATH_INFO stays within root.