fix xsrf cookie path should use root