Reworked fix for ignoring /APP/ (#11192)

* Fixed potential NPE by using existing helper method
* Pass /APP/ urls also to session handlers as at least GlobalResourceHandler requires it
* Fixed test to test /APP/ instead of /APP

Change-Id: I8d913e6a5509c63f8e47813fce5751f5279ed4fc