harden http store server against malicios urls

[pablochacin]

After the refactoring introduced in #76 the sanitizePath method, moved from the file store to a utility method, can no longer check the path passed points to a file within the data store directory. The corresponding test was disabled.

This creates a security risk that a forged URL could download any file using the store server.

The risk is mitigated because the store server does not get the URL to the file directly from user-supplied input. The URL is obtained from the object store using the object ID.