Set default cookie path to app's base path instead of "/".

This allows running multiple apps in subfolders under document root, without
interfering with each other or potentially other non-cake apps on same domain.
Of the 3 times, 1 is in `CookieComponent` for regular cookies unrelated to Session. I don't think it's necessary to inject the request object into session to avoid a single duplicate check.