correctly escape backslashes in request path globs

make sure that unreadable files are also not leaked

CVE-2014-7829
bumping version for relesase
Merge branch '4-1-sec' into 4-1-stable

* 4-1-sec:
  bumping version for relesase
  correctly escape backslashes in request path globs