contents: double check that os_path is always within root...
contents: double check that os_path is always within root
check based on tornado `StaticFileHandler.validate_absolute_path`
I haven't been able to actually escape root, but we should have this check anyway.