A mostly-bugfix update:

• Path-Canonical/Path-Mount now works properly in conjunction with Auth
• Path-Alias et al now support URL-encoded special characters for the path mapping
• Improved error handling; more cases of malformed and malicious URLs now result in a 400 Bad Request error instead of a 500 Internal Server Error