Restrict kickstart/snippet paths. Fix for #939 and CVE-2014-3225.