Reject box IDs outside project root
Reject box IDs outside project root

 * Add a check to validate_v1_path and validate_path to make sure
   requested file has provider.folder in its full path.

 [SVCS-463]

CenterForOpenScience/waterbutler,rdhyee/waterbutler,felliott/waterbutler,RCOSDP/waterbutler,TomBaxter/waterbutler