Prevent against directory traversal attacks.

Check if the full URL we will serve (be it a directory or a file) is contained in the root. Otherwise we return 403, as it means the user is trying to access some directory that should not be accessible.

http://en.wikipedia.org/wiki/Directory_traversal_attack