Check for path traversal after URL decoding

[andrew]

containsPathTraversal checks the raw path, but encoded traversal like %2e%2e%2f bypasses it. Run the check after url.PathUnescape as well.