Introduce the `strip` argument to Router.

This allows callers to request that the basepath *not* be stripped off
when normalizing string URL's. This is important in AuthComponent when
handling redirect URL's as the redirect location could point to
a controller that shares a name with the base path.

Refs #3897
Refs #3916
Update AuthComponent to not strip when normalizing URLs.

Revert most of the changes done to fix #3897 originally and try
a different strategy of solving the base path issues and not breaking
apps running in a subdirectory.

Fixes #3916