don't leak file descriptors

fix requri construction when we switched from one process to two, I introduced a small optimisation: empty string are not send, so we receive NULL. Constructing requri we need to make sure that relpath is not null.

split into two processes: listener and executor this way, we can sandbox the listener with seccomp (todo) or capsicum (already done) and still have CGI scripts. When we want to exec, we tell the executor what to do, the executor executes the scripts and send the fd backt to the listener.