Fix path traversal vulnerability

[carpusredden]

Hello,

Thanks for this Rust WebDAV implementation.

I found a path traversal vulnerability that you should be able to reproduce by running:

cargo run --example hyper

and then:

curl 'http://127.0.0.1:4918/%2e%2e/etc/passwd'

This PR proposes a way to handle this issue. I didn't read all this crate code, this patch may no be exhaustive.

I made a PR at messense/dav-server-rs#10 too.