Restrict cookie path to application root