check for access restriction ignores custom destination path

The security team cleared this issue to be fixed publicly.

If a custom destination backup path is set, the module's access-check uses the default path to compute the http request. Presumable, the requested path won't exist. So the check does not verify the access denial that should be caused by the created .htaccess file.
If the webserver ignored the .htaccess and an attacker knew the path, he could download the file.

Steps to reproduce:
in Drupal Administration:
- Administer -> Content management -> Backup and Migrate
- on tab "destinations":
- Manual Backups Directory - edit
- set to "sites/test/files/backup_migrate/manual", Save destination (note: maybe you have to create this path and give the webserver write access)
- on tab "backup":
- ensure Quick Backup to Manual Backups Directory
- click "Backup now"

gives the following apache error-log entry:
"File does not exist: /var/www/<host>/sites/default/files/ckup_migrate"
(Note: the missing "ba" in backup_migrate gives a hint.)

The module tries to check if http access to the backup directory is blocked, but uses the wrong (default) path instead of the custom (manual) backup directory path.

I believe the problem is in the file "backup_migrate/includes/destinations.file.inc":
- function check_web_dir($directory)
- function test_file_readable_remotely($path, $contents)
make use of file_directory_path() instead of using the custom backup directory path.