fix malicious path problem on windows

node repl
```
> process.platform
'win32'
> process.cwd()
'C:\\Users\\Administrator'
> path.resolve('desktop')
'C:\\Users\\Administrator\\desktop'
> path.join('C:\\Users\\Administrator','desktop')
'c:\\Users\\Administrator\\desktop'
```

- path.resolve ruturns `C` uppercase
- path.join returns `c` lowercase

That cause `if (path.substr(0, root.length) !== root)` fails on win7 even when path starts with root,but path with lowercase & root uppercase. Error message shows like `Forbidden`.