preventing directory traversal in dev server

[dthenley]

Due to unsafe usage of path.join, https://github.com/crowdfavorite/wp-capsule is vulnerable to Local File Inclusion vulnerability. You can read more about this vulnerability and its side effects here: https://cwe.mitre.org/data/definitions/22.html