Ensure cookies are only ever set for admin

fixes issue #1901

- Fixes the cookie path to include the trailing slash
- Adds a test which proves the case