Several security fixes

File manager ownership stricting: 
  dont list files that are not owned by client (except for admin). Dont get content of files not owned by client. 

Docroot check: 
  dont allow ../ in docroots (#1069)