normalize_path should not read past the end of the url string

Change-Id: I987f8233a7b3f2f3ebf3401e35c4f4367b4c9c17