Set default cookie path to app's base path instead of "/".

This allows running multiple apps in subfolders under document root, without
interfering with each other or potentially other non-cake apps on same domain.
Maybe add some more information to clarify what that means. like "if your app/website is running in a subdirectory of the website, the session-cookie will only be available for requests for that subdirectory and below." And that in most cases (app-root is `/`), it just means "the whole domain"