fix redirect and cookie path bugs