Insecure comparison

Without that fix, a path `/my-secret` is consedered fine for the root `/my`.

Maybe the issue is autofixed by the next `parts` assignment? Not sure exactly if the vulnerability exists, but the comparison is insecure.