Respect subdirectory in authenticate middleware

Commit d3c641ea31 broke subdirectory support. `req.path` includes the subdirectory, thus may not necessarily start with `"/ghost"`.

I don't know if a test could be added that tests subdirectories (particularly sadistic ones that would break unsanitary regex testing) and paths like `/ghost/` and `/ghost/signin/`, but I think that would be helpful. I might look into that if I have time, but I make no promises.