Multiple bugs in hostingcontroller

Different error message on wrong user name and password makes it possible to check account existance. Directory traversal allows to access files outside web root...