Triage CVE-2018-14574 for jessie LTS.

Tried backporting the patch/PoC/unittests to test:

  https://gist.github.com/lamby/79baa689aa3f6b5a30cb3a747e1f45be/raw

.. but pretty sure because it uses path over path_info Django never
even "sees" the leading double //.