FileHandler should not be called for files outside the root

FileHandler#matches? should return false for files that are outside the
"root" path.
Merge branch 'master-sec'

* master-sec:
  FileHandler should not be called for files outside the root