fix(static): reject encoded path separator to prevent route-level auth bypass

fix(static): reject encoded path separator to prevent route-level auth bypass #1513