Release security: make it impossible to clobber builddirs which have the "release prefix"

Shouldn't this raise an HTTP exception?  Although it looks like clobbering a totally nonexistent branch would succeed with "200 OK" as well, so maybe this is fine.