Forbidden is returned when root path contains ".."