http-backend: Protect GIT_PROJECT_ROOT from /../ requests