remove dep from 'parseurl' && 'path'

* remove `require('parseurl');`. Using built-in "url" parse. Resolve `should not choke on auth-looking URL` test.
* remove `require('path').resolve;`. Overhead, because this function is called inside "send" package.
* Move "throw !root" first of all, before parse options.
* `originalUrl` get previous parsed url if `req.originalUrl` is not defined.
* Extra semicolon.