generic hls / cookie token fixes

- need to return cache-control no-store for akamai to proxy the cookie
- need to use setrawcookie
- limit the cookie path and expiry according to the token
- add the token rootDir to the URL only when tokenizing it
- in manifest redirect, ignore the delivery url path