The `forbidden_request?` check could be trivially bypassed
by percent encoding .. as %2e%2e.

After auditing Sprockets and Hike and fuzzing a simple
server, I don't believe this is exploitable. However,
better safe than sorry/defense in depth/etc.

Various double slashes and URL encodings can bypass current checks.
In the case of the file existing, the server will 500 instead of 403
which leaks the existence but not the contents of the file.

Props to @eadz for finding this.