fix security issue allow read/delete/limited-write access to server

this fix does 2 things
1.  all user supplied hashes are validated
    they must be ascii formatted hexadecimal strings
2.  all blob paths are cleaned before descending below the base
    this ensures that you cannot get above the base using ..

both of these changes were tested individually to prevent the
undesired behavior.

closes #130