fix access_ticket_verify2() when using non-default webroot