Implemented:

 - allowed /web as a base path for vhost subdomains
 - added security checks when deleting vhost subdomains, so no paths still used by other subdomains or the main web get deleted accidently