Fix a path traversal issue when using root

fixes #59
fixes #60