Fix for ticket #3938

Reference: https://cakephp.lighthouseapp.com/projects/42648-cakephp/tickets/3938

I also did a merge of the master into 2.4 to get the fix from this morning. This way I think all those Auth bugs regarding the double base url have been resolved. I know I could have pushed directly to the 2.4 branch, but I wanted to make sure nothing got messed up.

Auth was broken in 2.4 because of a merge from master to 2.4 that went bad. A conflict wasn't entirely resolved and due to the lack of a test case for the base url thing it didn't came to light. This pull request adds a test for @markstory's earlier commit too, so this won't happen again.