module.php: Be more paranoid when verifying paths.

Cannot see a way that this can be used to escape the module www
directory, but being more specific in the test won't hurt.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2961 44740490-163a-0410-bde0-09ae8108e29a