Implement handler_file to forbid symlinks.

As of request I have modelled the way handler_common works as requested
in issue #927. Thus, if symlinks is disabled, requesting the file produces
a 404. This requires an extra lstat per request.

Fix #927