FIX: updated sessions path to use project dir
ENH: updated session cookie to limit to url-prefix