Auth fix related to #20

RFC2617 says “at or deeper than the depth of the last symbolic element
in the path field”, previously this code was only doing deeper than…